> For the complete documentation index, see [llms.txt](https://support.pipefile.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.pipefile.com/team-and-account/two-factor-and-device-verification.md).

# Two-factor authentication and device verification

Protect your login with an authenticator app or security key, keep backup codes, require two-factor for your team, and understand new-device emails.

Two-factor authentication adds a second step when you log in: after your password, you confirm it's you with something you have. It is available on every plan.

## Methods

| Method                | How it works                                                                                                  |
| --------------------- | ------------------------------------------------------------------------------------------------------------- |
| **Authenticator app** | A 6-digit code from an app on your phone, such as Google Authenticator, Microsoft Authenticator or 1Password. |
| **Security keys**     | A hardware key (for example a YubiKey) that you insert or touch.                                              |
| **Backup codes**      | Ten one-time codes for when you can't use your app or key. Each works once.                                   |

You get backup codes automatically when you add your first method.

## Set up an authenticator app

{% stepper %}
{% step %}

### Open Security

Go to [Account → Security](https://pipefile.com/dashboard/settings/account#security) and click **Set up** next to **Authenticator app**.
{% endstep %}

{% step %}

### Scan the QR code

Scan it with your authenticator app. If you can't scan, use **Can't scan? Enter this setup key** and type the key into the app.
{% endstep %}

{% step %}

### Enter the code

Type the 6-digit code the app shows and confirm.
{% endstep %}

{% step %}

### Save your backup codes

Copy or download the codes and store them somewhere safe, then click **I've saved these codes**. We only show them once.
{% endstep %}
{% endstepper %}

## Add a security key

In [Account → Security](https://pipefile.com/dashboard/settings/account#security), choose **Add a security key**, give it a **Key name** (like "Office YubiKey") and click **Add key**. Your browser asks you to insert or touch the key. Add a second key so losing one doesn't lock you out.

## Logging in with two-factor

After your password, Pipefile shows **Confirm it's you**. Enter the code from your app, or choose **Use your security key** or **Use a backup code**.

Once you've logged in on a browser, that browser is remembered for 30 days and usually won't ask for a code again. You'll be asked again on a new browser, after clearing cookies, or after adding or removing a method (which makes every browser ask at the next login).

Pipefile may also ask you to confirm it's you again before a security change, such as removing a method.

## Manage your methods

* **Replace** your authenticator app when you get a new phone: scan the new QR code and enter a code from the new app. The old app stops working when you finish.
* **Regenerate** backup codes if you've used several or think they're exposed. Old codes stop working immediately.
* **Remove** a method. If your team requires two-factor, you can't remove your last method; add another first.

We email you whenever a method is added, removed or replaced, and whenever a backup code is used.

## Lost your phone or key

1. Log in with a backup code, then replace or remove the lost method in **Security**.
2. No backup codes? Ask a team admin to reset your two-factor authentication.
3. No admin can help? Email <support@pipefile.com>.

## For team admins

### Require two-factor for your team

Go to [Team → General](https://pipefile.com/dashboard/settings/team#general), click **Edit**, turn on **Require two-factor authentication**, click **Save**, and confirm with **Require**. You need two-factor on your own account first.

Members who haven't set it up are emailed, see a banner, and can keep working; they're asked to set it up at their next login. Members who log in with [SSO](/team-and-account/single-sign-on.md) are covered by their identity provider and aren't asked.

On the **Users** list, a **2FA** tag shows who has it on and **SSO** shows who logs in through SSO.

### Reset a member's two-factor

On [Team → Users](https://pipefile.com/dashboard/settings/team#users), open the **...** menu next to the member and choose **Reset two-factor authentication**, then **Reset**. This removes their authenticator app, security keys and backup codes, and emails them. You can't reset your own or the team owner's.

## New device verification

When you log in with a password from a browser, operating system or network we haven't seen for your account, Pipefile shows **Authorize this device** and emails you a confirmation link. This happens even with the same laptop on a different network, such as home and office.

1. Open the email and click the link. It works for 12 hours.
2. Return to Pipefile and log in again on the same device.

If the link says **This code has expired**, log in again to get a new email. Can't find the email? See [Emails not arriving](/troubleshooting/emails-not-arriving.md).

## Related

* [Login issues](/troubleshooting/login-issues.md)
* [Change your email or password](/team-and-account/email-and-password.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://support.pipefile.com/team-and-account/two-factor-and-device-verification.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.