Account security

To protect your Qualflare account, add a second factor, an authenticator app or a passkey, under Account; two-factor authentication is on as soon as you have one, and your first factor comes with 10 one-time recovery codes.

Before you begin

• Every account can do this, on every plan, from the Account page.
• Adding an authenticator app or a passkey, or connecting GitHub or Google, asks Confirm it’s you when you last confirmed more than 5 minutes ago.

Single sign-on (SSO)

If a workspace you belong to requires SSO (Enterprise plan) and your email address is at one of its verified domains, you sign in through your organization's identity provider: enter your work email on the sign-in page and select Continue. Password, Google, and GitHub sign-in stop working for your whole Qualflare account, not just that workspace. If your email is at another domain, Require SSO doesn't cover you.

SSO doesn't replace two-factor authentication. If you have a second factor, Qualflare asks for it after your identity provider signs you in. If you have none and a workspace you belong to requires one, you set up an authenticator app first and then sign in again.

Setting up an SSO connection is a task for the workspace Owner, not an individual account setting. See Single Sign-On.

Two-factor authentication (2FA)

Two-factor authentication adds a second step to your sign-in.

If a workspace you belong to requires two-factor authentication and you have no second factor, you must set up an authenticator app at your next sign-in. See Workspace Settings.

Set up an authenticator app

1. Go to Account → Two-Factor Authentication
2. Click Enable Two-Factor Authentication (Add an authenticator app if you already have a passkey)
3. Scan the QR code with an authenticator app (Google Authenticator, Authy, 1Password, etc.) and click Continue
4. Enter the 6-digit code from the app and click Verify & Enable
5. Save your 10 recovery codes, then click I've saved my codes

This signs out your other devices.

Turn off the authenticator app

1. Go to Account → Two-Factor Authentication
2. Click Disable Two-Factor Authentication (Turn off authenticator app if you also have a passkey, which keeps two-factor authentication on)
3. Enter the current 6-digit code from your authenticator app and click Disable Two-Factor Authentication

This signs out your other devices. If a workspace you belong to requires two-factor authentication, you can turn off your authenticator app only if you have a passkey.

Lost your authenticator app? In the same dialog, click Lost your authenticator?. Enter a recovery code and click Continue, scan the new QR code, enter the new app's code, and click Replace authenticator. Then save your new recovery codes.

Passkeys

A passkey is a second factor on its own: with one, two-factor authentication is on even without an authenticator app, and it meets a workspace's two-factor requirement. You confirm it with Face ID, Windows Hello, or a security key instead of typing a 6-digit code.

Add a passkey

1. Go to Account → Passkeys
2. Click Add a passkey, optionally name it, and click Continue
3. Follow your browser/OS prompt to create the passkey (Face ID, Touch ID, Windows Hello, or a hardware security key)
4. If this is your first second factor, save the recovery codes Qualflare shows, then click I've saved my codes

You can register up to 20 passkeys.

Sign in with a passkey

Once you have a passkey registered, sign in as usual. On the two-factor step, your browser may offer your passkey, or you can click Use a passkey. Confirm it with your fingerprint, face, or security key.

Remove a passkey

1. Go to Account → Passkeys
2. Click the trash icon next to the passkey you want to remove
3. Click Verify with passkey. If you have an authenticator app, you can instead click Use an authenticator code instead, enter the code, and click Remove.

You can't remove your last passkey unless you also have an authenticator app. Adding or removing a passkey signs out your other devices. To rename a passkey, click its pencil icon.

Manage active sessions

1. Go to Account → Sessions
2. Your Current Session is listed first, then Other Sessions. Each shows its browser and operating system, the IP address it signed in from (and Last seen from when that changed), and when it signed in and was last active.
3. To end a session you don't recognize, click its trash icon, then Revoke Session. That device is signed out immediately.

A session ends after 30 days without use, and after 90 days in any case. An account holds at most 10 sessions: signing in on another device ends the oldest. A session from a single sign-on lasts as long as the workspace's SSO session lifetime.

Revoke All Other Sessions ends every session except this one. Sign out everywhere ends all of them, this one included.

Connected accounts (OAuth)

You can connect GitHub or Google to sign in without a password. SSO links appear as separate rows, labeled Single sign-on - and the workspace name.

Connect an account

1. Go to Account → Connected Accounts
2. Click Connect next to GitHub or Google
3. Complete the OAuth authorization flow
4. The provider is now linked — you can sign in using this account

Disconnect an account

1. Go to Account → Connected Accounts
2. Click the trash icon next to the provider
3. Click Disconnect to confirm

Connecting or disconnecting a provider signs out your other devices.

Change your password

1. Go to Account → Update Password
2. Enter your Current Password
3. Enter your New Password and Confirm Password
4. Click Update Password

This signs you out on every other device. Your access tokens keep working.

Forgot it? Click Forgot your current password? to sign out and reset it by email. If you signed up with GitHub, Google, or SSO and have no password yet, click Sign out and set a password.

New IP login alerts

Qualflare emails you when your account is signed in from a network it hasn't been used from in the last 30 days. If that wasn't you, change your password, revoke sessions you don't recognize, and check your second factors.

Qualflare also emails you about other security changes, such as a new password, second factor, passkey, connected account, or access token.

If an email has a This wasn't me: lock my account link and you didn't make the change, click it (it works once, for 7 days), click Lock my account, then click Reset your password.

Troubleshoot

• "Set a password or connect another sign-in method first": set a password, or connect GitHub or Google, before you disconnect.
• Lost your authenticator app: use a recovery code (see above).
• Confirm it’s you: see Before you begin.

Next steps

• Single Sign-On
• Require two-factor authentication
• Access tokens (sign out everywhere revokes them)
• Roles and permissions