A code from your phone on top of every sign-in.

1. Open Security and two-factor and press Set up an authenticator.
2. Scan the QR code with an authenticator app such as 1Password, Google Authenticator or Authy, or type the key by hand. The QR code is drawn on our server; the key never goes to an outside service.
3. Type the 6-digit code the app shows. Setup only finishes in the browser that started it.
4. Save the 10 recovery codes shown next. They appear once. We keep only a keyed hash of each, so we cannot show them again.

From then on each sign-in, with Google, single sign-on or an email link, asks for a code before any page opens. There is no box to remember a browser: a browser stays verified until you sign out or its session ends.

Each code works once. After 5 wrong codes in 10 minutes, code entry locks for 10 minutes, and each lock in the same day lasts twice as long as the one before. A recovery code still works during a lock.

• On the code screen choose Use a recovery code. Each one works once. When two or fewer are left you are sent to make new ones.
• To replace every code, or to turn two-factor off, confirm with a code from your app. Turning it off is refused while a workspace you belong to requires it.
• Lost the phone? Sign in with a recovery code, then use Sign out on each device you do not recognise under Signed-in devices, or Sign out everywhere else.

An owner can require two-factor for everyone in the workspace from a chosen date. After it, a member without an authenticator can open only the setup page. The policy panel lists who has not enrolled yet.

Granting an agent an auto-keep policy, changing someone’s authority, billing, single sign-on settings, revoking a key and the policy itself ask for a code entered in the last 10 minutes on that browser.

With single sign-on required, a sign-in counts as verified when your identity provider says it used more than one factor (an OIDC amr of mfa, otp or hwk, or a SAML multi-factor authentication context). Otherwise the CommitOps code is asked as usual.

Agents sign in with keys and have no second factor. Over the API and MCP they cannot change any of the above.

Where it is switched on, /signin offers a link by email for people without a Google account. The link works once and expires in 10 minutes. A domain whose workspace requires single sign-on is refused a link, exactly as it is refused Google.