Two-factor sign-in and account security
Turn on two-factor authentication with an authenticator app, keep recovery codes, change your password, and what signs you out everywhere.
On this page
Your account holds contracts, costs and the people on every job. This page covers the security settings each person controls in My Profile, and what happens behind them. For how we host and protect data, see Security.
Turn on two-factor authentication
Two-factor uses any authenticator app that supports time-based codes (TOTP).
-
Open My Profile
Open the account menu in the top bar (Account & Profile) → My Profile (
app.os.construction/account). Scroll to Two-factor authentication and select Set up authenticator. -
Add the account to your authenticator app
Add a time-based account in your app and type in the setup key shown on screen.
-
Save your recovery codes
The page shows a set of recovery codes once, during this setup. Select Download recovery codes or copy them somewhere private. Each code works once, if you lose your phone. Tick I saved my recovery codes.
-
Confirm
Enter the six-digit authenticator code from your app and select Confirm authenticator.
Confirming signs you out and revokes your API tokens. Sign back in with your password and the next code from your app.
Signing in with two-factor on
On the sign-in page, enter your email, password and a code in Authenticator or recovery code. Use a fresh code from your app, or one of your unused recovery codes. Every code works once.
Lost your phone and your recovery codes? Contact us to recover the account.
Turn two-factor off
In My Profile → Two-factor authentication, enter a fresh authenticator code or an unused recovery code and select Disable two-factor authentication. This also signs you out and revokes your API tokens.
Change your password
In My Profile → Change Password, enter your current password and a new one of at least 8 characters. Changing it signs out your other sessions and revokes your API tokens.
A Forgot password link on the sign-in page, which emails a one-time reset link valid for one hour, arrives with self-serve signup (Preview).
What signs you out everywhere
These actions end every browser session and delete every API token for the account:
- Turning two-factor on or off.
- Changing your password.
- A company admin deactivating your account, or your identity provider deprovisioning you over SCIM.
API sign-in
API tokens come from the same account, so two-factor applies there too: when it’s on, send mfa_code with your email and password to /oauth/token. See the developer docs.
What’s Planned
- Single sign-on with SAML or OIDC.
- A company policy that requires two-factor for everyone.
- Machine credentials for integrations that don’t belong to a person.
Was this helpful?
Run it on your own project.
Start a 14-day free trial. Want a say in what ships next? Join the founding program.
14-day free trial. Pricing for paid plans isn't set yet. Talk to us. Already have an account? Sign in →