# Two-factor authentication and passkeys > Source: https://truto.one/docs/guides/team-security/two-factor-and-passkeys/ Turn on two-factor authentication for your own account, require it for everyone on the team, and add passkeys so you can sign in with a fingerprint, face, or device PIN. Everything on this page lives at **Settings → Security** (`https://app.truto.one/settings/security`). :::skip-reading{} ::: ## Who can change what Every team member sees **Settings → Security** and manages their own two-factor authentication, backup codes, and passkeys there. Only team admins see the **Team security** card at the top of the page. It holds the two team-wide settings: **Allow impersonation** and **Require two-factor authentication for all team members**. If a member sends either setting to the API, Truto ignores it. ## Turn on two-factor authentication for your account Truto's second factor is a TOTP authenticator app, such as Google Authenticator, Authy, or 1Password. Codes are 6 digits. 1. Open **Settings → Security**. 2. In the **Two-factor authentication** card, click **Enable two-factor authentication**. 3. Scan the QR code with your authenticator app. If you can't scan it, click **Can't scan? Enter key manually** and type the key into the app. 4. Enter the 6-digit code under **Enter the 6-digit code to verify** and click **Verify and enable**. 5. Save the backup codes Truto shows you, then click **Done**. Use **Download** to save them as `truto-backup-codes.txt`, or the copy button to copy them. The card now shows an **Enabled** badge. Truto emails you whenever two-factor authentication is turned on for your account. From then on, signing in with a password, a login link, or Google, GitHub, or Microsoft takes you to a **Two-factor authentication** page. Enter the 6-digit code from your authenticator app and click **Verify**. ## Require two-factor authentication for the team 1. As a team admin, open **Settings → Security**. 2. In **Team security**, check **Require two-factor authentication for all team members**. 3. Click **Save changes**. New teams start with this setting turned on. When it is on, any member without an authenticator app is sent to **Set up two-factor authentication** the next time they sign in with a password, a login link, or Google, GitHub, or Microsoft. They scan the QR code, enter a code, and click **Verify and enable**. Then they save their backup codes, check **I have saved these backup codes**, and click **Continue**. While the requirement is on, members can't turn off their own two-factor authentication. The **Disable two-factor authentication** link is hidden. Some sign-ins skip the code prompt because the identity check already happened somewhere else: - **Passkey sign-ins.** The passkey verifies you on the device. - **Enterprise single sign-on.** Your identity provider verifies you. See [Single sign-on](/docs/guides/team-security/sso). :::callout{type="info"} If your organization enforces single sign-on, members sign in through the identity provider. They can't add passkeys or sign in with them. Clicking **Add passkey** shows "Passkeys are disabled for this organization. Please use SSO." ::: ## Sign in with a backup code You get eight single-use backup codes, each shaped like `xxxx-xxxx`. They let you sign in when your authenticator app isn't available. 1. On the **Two-factor authentication** page, click **Use a backup code instead**. 2. Enter one code under **Backup code** and click **Verify**. Each code works once. **Settings → Security → Backup codes** shows how many you have left, for example "6 of 8 backup codes remaining". :::callout{type="warning"} After five wrong codes (authenticator or backup) within 15 minutes, Truto deactivates the account and signs it out everywhere. Team admins can't reactivate it. Email support@truto.one to get the account turned back on. ::: ## Regenerate backup codes 1. In **Settings → Security**, under **Backup codes**, click **Regenerate backup codes**. 2. Confirm with **Regenerate**. All of your old codes stop working, and eight new ones appear under **New backup codes**. They are shown only once, so download or copy them before you leave the page. ## Change your authenticator app 1. Under **Authenticator app**, click **Change authenticator app**. 2. Scan the new QR code with the new app. 3. Enter a code under **Enter the 6-digit code from your new app** and click **Verify and switch**. Changing the app also replaces your backup codes, and the new set appears on the page. Truto emails you about the change. ## Turn off two-factor authentication Click **Disable two-factor authentication**, then **Disable**. This removes your authenticator app and your backup codes. The link is hidden while your team requires two-factor authentication. ## Add a passkey A passkey lets you sign in with your fingerprint, face, or device PIN instead of a password or login link. Signing in with a passkey doesn't ask for your authenticator code. 1. In the **Passkeys** card, click **Add passkey**. 2. Prove it's you. If you have two-factor authentication, enter a code from your authenticator app. If you don't, but you have a password, enter your password. 3. Follow your browser's or device's prompt to create the passkey. 4. In **Name this passkey**, give it a name such as `MacBook Touch ID` and click **Save**, or click **Skip**. Truto emails you when a named passkey is added to your account. If you didn't add it, remove it straight away. You can have up to 20 passkeys. Each one appears in a table with **Name**, **Added**, **Last used**, and **Sync** columns. Use the edit button to rename a passkey. If your browser doesn't support passkeys, the card says so. You can still remove passkeys you added elsewhere. ## Sign in with a passkey On the **Sign in to Truto** page, click **Sign in with a passkey** and pick the passkey your device offers. There's no email or password to type. ## Remove a passkey Click the delete button on the passkey's row, then confirm **Delete passkey?** with **Delete**. That passkey stops working right away. ## Allow Truto support to impersonate users **Allow impersonation** lets Truto's support team sign in as users on your team to investigate a problem. Everything the support team does is logged and audited. It is on for new teams. To turn it off, uncheck **Allow impersonation** in **Team security** and click **Save changes**. Truto support can no longer impersonate anyone on the team. A support session can't add or remove passkeys. API calls made during one are labelled **Called by Truto staff** in [the logs](/docs/guides/logs/viewing-logs). ## Next If your organization has an identity provider, set up [single sign-on](/docs/guides/team-security/sso) to manage sign-in centrally. Use [SCIM](/docs/guides/team-security/scim) to provision and remove members from the identity provider.