Two-factor authentication

Two-factor authentication (2FA) adds a second check when you sign in: even if someone gets your password, they can't enter your account without the 6-digit code from your authenticator app. Strongly recommended for workspace owners and admins, and worth turning on for any account you treat as work-critical.

This article walks through enabling 2FA, what to do with your recovery codes, and how to disable it.

How it works

When 2FA is on, signing in to Claos takes two steps:

1. Enter your email and password.
2. Open your authenticator app, read the 6-digit code it shows for Claos, and enter it.

The code rotates every 30 seconds, so a captured password by itself isn't enough to get in.

Setting it up

1. Open Settings → Security → Two-Factor Authentication.
2. Click Enable MFA. Claos shows a QR code.
3. Open an authenticator app on your phone — Google Authenticator, Authy, 1Password, Bitwarden, or any TOTP-compatible app — and scan the QR code. If the phone can't scan, copy the secret string from the screen and add it to the app manually.
4. The app starts showing a 6-digit code for Claos that changes every 30 seconds.
5. Enter the current code on the Claos screen to confirm setup.

Recovery codes

After you confirm setup, Claos shows you 8 recovery codes. Save them somewhere safe — a password manager is ideal, or a printed copy stored offline.

Each recovery code can be used once if you ever lose access to your authenticator app. They are your backup for the case where the phone with the app on it is lost, broken, or wiped.

There's a Copy All button on the dialog to grab them in one go.

Signing in with 2FA

After 2FA is enabled, every sign-in adds the 6-digit step:

1. Enter your email and password as usual.
2. The 6-digit code prompt appears.
3. Open your authenticator app, read the current code for Claos, enter it.
4. You're signed in.

Using a recovery code

If you can't get to your authenticator app — phone lost, app reset, travelling without it — you can sign in with a recovery code instead:

1. At the 6-digit prompt on the sign-in page, choose Use a recovery code.
2. Enter one of your saved codes.
3. You're signed in.

The code you used is consumed and can't be used again. The remaining codes still work. If you've used most of them, disable and re-enable 2FA to generate a fresh set.

Disabling 2FA

1. Open Settings → Security → Two-Factor Authentication.
2. Click Disable MFA.
3. Enter the current 6-digit code from your authenticator to confirm.

2FA is now off. You can turn it back on any time from the same screen.

What 2FA method is supported

TOTP only — the 6-digit code from an authenticator app. Claos doesn't currently support SMS codes, WebAuthn, passkeys, or hardware security keys. TOTP is the most portable option and works with every common authenticator app.

If you lose your authenticator and your recovery codes

There's no in-app recovery for an account that has lost both the authenticator and every recovery code. Contact support with proof of identity — they'll work through it with you.

Save the recovery codes the moment Claos shows them to you. That's their entire purpose: they're the safety net for the case the app makes harder to recover.

Tips and gotchas

• Recovery codes are single-use. Once a code is consumed, it can't be reused. Keep track of how many you have left in Settings → Security.
• 2FA is per-account, not per-workspace. Once enabled, it applies every sign-in regardless of which workspace you're entering.
• Phone clocks drift. If the codes the app shows you start failing, check that the phone's clock is set to "auto" / network time. TOTP relies on accurate time on both ends.
• Switching authenticator apps is easy. Disable 2FA in Claos, set up the new app, re-enable. The recovery codes are regenerated when you re-enable, so save the new ones.

Related

• Your profile
• Sessions and account closure