# Two-factor & sessions > Protect INFRO accounts with an authenticator app, recovery codes and passkeys, see and end signed-in sessions, and require two-factor for a whole organization. Source: https://infro.io/docs/org/security > **Note:** INFRO is in private early access. Running these examples requires an early-access account, an active trial or subscription entitlement, and your own provider connection. Self-serve purchasing is not generally open. See [Early access](https://infro.io/early-access). An INFRO account can reach an organization's provider connections, routes, budgets and gateway keys, so it is worth more than a password. Every account can add a second step to its sign-in, and an owner or admin can require it for the whole organization. All of it is on every plan. ## Methods | Method | What it is | Used for | | --- | --- | --- | | Authenticator app | A six-digit code that changes every 30 seconds, from 1Password, Google Authenticator, Microsoft Authenticator, Authy or any TOTP app. | The second step after your password. Turning it on is what turns two-factor on. | | Recovery codes | Ten one-time codes, shown once when you turn two-factor on or create new ones. | The second step when your authenticator is not at hand. Each works once. | | Passkey or security key | Touch ID, Face ID, Windows Hello, a passkey in your phone or password manager, or a hardware key such as a YubiKey. | Signing in without a password, or the second step after one. | INFRO does not send codes by email or SMS. Your mailbox is where password resets go, so a password plus an emailed code is one factor twice, and SMS codes can be intercepted by moving your phone number. ## Turn on two-factor 1. Open **Account settings** in the console and find **Two-factor authentication**. 2. Choose **Set up two-factor authentication** and enter your password. 3. Scan the QR code with your authenticator app, or type the setup key into it. 4. Enter the six-digit code the app shows, then save your ten recovery codes (copy or download them). > **Note:** Turning two-factor on **signs out every other session** of your account. Sessions from before it existed never proved a second factor, so they do not survive it. From then on, signing in with your password asks for a code, a recovery code, or your passkey or security key. There is no *remember this device*: every password sign-in asks. Ten wrong codes in a row lock two-factor for 15 minutes. ## Passkeys and security keys Add one under **Account settings → Passkeys and security keys**. Your browser offers to save it on the device, in your password manager, or on a hardware key. You can register several and name each one. - **Sign in with a passkey** on the sign-in screen, or pick it from the email field's autofill. This needs no password, and no code afterwards, because the device verifies you with a PIN or biometric. A key that cannot verify you (a hardware key with no PIN set) is refused for this. - **As the second step:** after your password, choose **Use a passkey or security key**. Here the key only has to be present, so any registered key works. ## Confirm it's you Changing how you sign in (turning two-factor off, creating new recovery codes, adding or removing a passkey) needs a confirmation from the last **10 minutes**. The console asks only when it is needed, and one confirmation covers every change for those ten minutes. With two-factor on, you confirm with a code, a recovery code or a passkey. **Your password alone is not enough**, so somebody holding an open browser and your password still cannot remove your second factor. Without two-factor, your password or a passkey confirms. An account with neither (for example, one that only signs in with Google) is asked to sign in again. ## Sessions **Account settings → Where you're signed in** lists every browser signed in to your account: browser and operating system, approximate location and IP address, how it signed in (for example *Password + authenticator app*, *Passkey*, *Google*) and when it was last active. **Sign out** ends one session; **Sign out of all other sessions** ends everything except the browser you are using. If you see one you do not recognise, end it and change your password. ## Require two-factor for your organization Owners and admins can turn on **Require two-factor authentication** under **Settings → General**. You need two-factor on your own account first. - Members without two-factor are emailed when you turn it on. Until they set it up, the console shows them the setup screen and nothing else in this organization. - Members who sign in through your organization's [single sign-on](https://infro.io/docs/org/sso) satisfy it: your identity provider enforces its own MFA. - **API keys and management tokens are not affected.** They are machine credentials, and your traffic keeps flowing. - To replace an authenticator app (a new phone, say), a member turns two-factor off and sets it up again under Account settings. In between, the organization shows them only the setup screen. - **Settings → Members** shows owners and admins who has two-factor on. Turning the policy on or off is recorded in the [audit log](https://infro.io/docs/org/audit-log). ## Google, GitHub and single sign-on Signing in with Google, GitHub or your organization's SSO does not ask for INFRO's second factor. Those providers run their own sign-in protection, so turn on two-step verification with them too. For an organization that requires two-factor, only an SSO sign-in counts on its own. A member who signs in with Google or GitHub still needs two-factor turned on for their INFRO account. ## Lost your authenticator? 1. Use a **recovery code** on the sign-in screen (**Use a recovery code instead**). 2. Or use a **passkey or security key**. A synced passkey usually survives a lost phone. 3. Or, from any browser that is still signed in, turn two-factor off or set up a new authenticator. 4. If none of those is possible, contact support **from your account's email address**. We verify who you are before turning two-factor off, which includes confirmation from your organization's owner or an admin and a waiting period. This protects you from someone pretending to be you. We will email your account's address when it is done.