Two-factor authentication & passkeys

Add a second layer to your sign-in so a stolen or guessed password is not enough to reach your account. Manage everything under Security (/settings/security).

You can use any combination of:

Method	What it is	Role
Authenticator app	Time-based codes (TOTP) from Authy, Google Authenticator, 1Password, …	Second factor after your password
Security key	A hardware key (YubiKey and similar)	Second factor after your password
Passkey	A credential on your phone/laptop unlocked by fingerprint, face or device PIN	Sign in without a password
Recovery codes	Ten single-use backup codes	Get back in if you lose your other factors

Why it matters

Passwords leak. They get reused across sites, phished on lookalike pages, and exposed in breaches you never hear about. Once someone has your password, they have your account — and everything it controls: your devices, your fleets, your deployments.

A second factor breaks that. Even with your password, an attacker also needs something they don't have — a code from your phone, a tap on your hardware key, or your fingerprint. Passkeys go further and remove the password from the equation entirely, which also removes the thing most often stolen.

If your account can push updates to real devices, this is worth the two minutes it takes to set up.

Set up an authenticator app

1. Go to Security → Authenticator app → Enable authenticator app.
2. Confirm it's you (your password, or an existing factor — see Confirming sensitive changes).
3. Scan the QR code with your authenticator app, or type the shown secret in manually.
4. Enter the 6-digit code the app displays to confirm.
5. Save your recovery codes. They are shown only once — copy or download them and keep them somewhere safe.

From now on, signing in asks for a code from the app after your password.

Add a passkey

A passkey lets you sign in with just your fingerprint, face or device PIN — no password, no code to type.

1. Go to Security → Passkeys → Add passkey.
2. Confirm it's you.
3. Your browser or operating system prompts you to create the passkey — choose this device, a phone, or a hardware key, and approve it (fingerprint / face / PIN).
4. It appears in the Passkeys list, where you can rename or remove it.

To sign in with it later, click Sign in with a passkey on the login page — or just click the username field, where saved passkeys are offered in the browser's autofill.

Add a security key

A security key is a hardware device used as a second factor after your password (rather than replacing it).

1. Go to Security → Security keys → Add security key.
2. Confirm it's you.
3. Touch your key when the browser prompts.

At your next sign-in, after your password you'll be asked to touch the key.

Recovery codes

Enabling your first factor generates ten recovery codes. Each works once, and only to sign in if you've lost access to your other factors. Store them like passwords — a password manager or a printout in a safe place.

Running low or think they leaked? Security → Recovery codes → Regenerate recovery codes issues a fresh set and invalidates the old one.

Signing in with two-factor enabled

1. Enter your username and password as usual.
2. Instead of signing you straight in, the Hub asks for your second factor and offers whatever you've set up — an authenticator code, a security key, or a recovery code.
3. Provide it, and you're in.

Signing in with a passkey skips step 2 entirely: the passkey proves both possession (your device) and you (your fingerprint/PIN) in one step.

Confirming sensitive changes

Changing your security settings — adding or removing a factor, regenerating recovery codes — always asks you to confirm it's really you first:

• If your account has a password, you type it.
• If you sign in only with a passkey or a social provider (no password to type), you re-prove an existing factor instead — tap your passkey, or enter an authenticator or recovery code.

This means that even if someone gets hold of an open session, they still can't quietly take over your account's security.

How it keeps your account secure

• Your password is never enough on its own. With two-factor on, a correct password only gets you to the second-factor step — never straight to a session.
• Passkeys and security keys are phishing-resistant. They are bound to the real Hub's web address, so a lookalike phishing site can't use them even if it tricks you into trying. There is no code to read out or paste into the wrong place.
• Nothing secret leaves your device for passkeys. The private key stays on your phone or laptop; the Hub only ever stores the matching public key. Unlocking it needs your fingerprint, face or PIN.
• Codes can't be replayed. An authenticator or recovery code works exactly once; a code an attacker sniffs is already spent.
• Secrets are protected at rest. Your authenticator secret is stored encrypted, and recovery codes are stored hashed — never in the clear.
• Guessing is throttled. Repeated wrong codes lock the second-factor step for a while, so the 6-digit space can't be brute-forced.
• Backup codes are single-use. Losing a phone doesn't lock you out, and a used code can't be reused.

Losing a factor

• Lost your phone / authenticator: sign in with a recovery code, then add a new factor and regenerate recovery codes.
• Lost everything, including recovery codes: contact your Hub administrator to reset two-factor on your account.

Related

• Accounts, identity & tokens — how sign-in and tokens work.
• Settings — the rest of your account settings.
• Tokens — API and device tokens for automation (these are the right tool for scripts and CI, which don't go through two-factor).