Confirm it’s you first
Turning on the authenticator and adding a passkey both start by confirming that this is the account’s owner. Being signed in isn’t enough: otherwise someone holding a session could add their own second factor and lock the owner out.Add a passkey
1
Open the setting
In the Passkeys row of Account settings → Security & sign-in, click Add a passkey, and
confirm it’s you as above.
2
Create it
Give it a name if you like, such as “My MacBook”, click Create, and follow the prompt from the
browser or the system.
3
Save the recovery codes
When this is the account’s first second factor, multi-factor authentication turns on and ten
recovery codes appear, shown only this once. Keep them with Copy or Download, then click
I’ve saved them.
When a computer has no passkey at hand, the browser can also show a QR code to confirm with a passkey on
a phone.
In the list, a passkey without a name shows where it is kept; when the browser doesn’t report that, it
shows only Passkey.
What the instance needs
A passkey is bound to the instance’s domain name, which brings these requirements. Without them, Add a passkey is greyed out with the reason, and the sign-in page doesn’t offer passkeys.
After the host name of
external_url changes, existing passkeys stop working: sign in with the password
or a recovery code and add them again.
Turn on the authenticator
1
Open the setting
In the Authenticator app row of Account settings → Security & sign-in, click Turn on, and
confirm it’s you as above.
2
Add it to the authenticator app
Scan the QR code with the authenticator app, or type in the key shown under it. The app lists
the entry as MoleSignal; with
[http].external_url set, the name carries its host name, which
tells several instances apart.3
Enter the first code
Enter the 6-digit code the app shows and click Turn on. It turns on only once the code
matches.
4
Save the recovery codes
When this is the account’s first second factor, ten recovery codes appear, shown only this once.
Keep them with Copy or Download, then click I’ve saved them.
Sign in
With a passkey, without a password
On the sign-in page, click Continue with a passkey, or click Sign in with email, then the email field, and pick the passkey from the browser’s suggestions. A passkey already asks for a fingerprint, your face, or your device’s passcode, so it counts as multi-factor authentication and there is no second step.Too many wrong passwords
After too many wrong passwords, the sign-in page says how long to wait. A passkey or a password reset gets around the wait: a passkey is neither counted nor limited, so the account’s owner can still get in while someone else is guessing its password, and a successful reset unlocks the account at once. See Sign-in limits for the numbers.The second step after the password
After the password, the sign-in page asks to Verify it’s you, with the second factors the account has:Which sign-ins ask for the second step
Manage recovery codes
If you lose your authenticator and passkeys, each recovery code signs you in once. The Recovery codes row of Security & sign-in shows how many are left. Make new codes asks for a confirmation and gives ten new recovery codes; the old ones stop working.Change your second factors
Apart from renaming, each of these asks for a confirmation on the spot with a passkey, a code, or a recovery code.
Removing the account’s last second factor turns multi-factor authentication off: the recovery codes stop
working and the account’s email gets a notice. While a workspace of the account
requires multi-factor authentication, that isn’t possible:
Turn off and Delete are greyed out and say which workspace requires it.
Reset by an administrator
When a member has lost every second factor and used up the recovery codes, an administrator opens the member’s actions under Identity & Access → Users and clicks Reset multi-factor authentication. This requiresorg.members.mfa_reset. The member’s authenticator, passkeys, and recovery
codes stop working, every device is signed out, and the account’s email gets a notice; the member
then signs in with the password and sets it up again; where a workspace requires it, as part of signing
in.
The MFA column of the Users list shows whether each member has it on.
Offline reset
When the root user has lost every second factor, or no administrator can sign in, run on the server:Sign-ins that end
These actions end the account’s sign-ins in other browsers and on other computers, from the next request made there:- adding a first second factor, which turns multi-factor authentication on;
- replacing or turning off the authenticator, or deleting a passkey;
- an administrator’s reset;
- Sign out all other devices under Active sessions;
- resetting the password from the emailed link, which ends every sign-in of the account.