# Account security

Source: https://docs.qualflare.com/docs/administration/account-security · Last updated: 2026-10-27

Protect your Qualflare account with an authenticator app or passkeys, recovery codes, session and device control, connected sign-ins and security emails.

To protect your Qualflare account, add a second factor, an authenticator app or a passkey, under **Account**; two-factor authentication is on as soon as you have one, and your first factor comes with 10 one-time recovery codes.

## Before you begin

* Every account can do this, on every plan, from the **Account** page.
* Adding an authenticator app or a passkey, or connecting GitHub or Google, asks **Confirm it’s you** when you last confirmed more than 5 minutes ago.

## Single sign-on (SSO)

If a workspace you belong to requires SSO (Enterprise plan) and your email address is at one of its verified domains, you sign in through your organization's identity provider: enter your work email on the sign-in page and select **Continue**. Password, Google, and GitHub sign-in stop working for your whole Qualflare account, not just that workspace. If your email is at another domain, **Require SSO** doesn't cover you.

SSO doesn't replace two-factor authentication. If you have a second factor, Qualflare asks for it after your identity provider signs you in. If you have none and a workspace you belong to requires one, you set up an authenticator app first and then sign in again.

Setting up an SSO connection is a task for the workspace Owner, not an individual account setting. See [Single Sign-On](https://docs.qualflare.com/docs/administration/sso).

## Two-factor authentication (2FA)

Two-factor authentication adds a second step to your sign-in.

If a workspace you belong to requires two-factor authentication and you have no second factor, you must set up an authenticator app at your next sign-in. See [Workspace Settings](https://docs.qualflare.com/docs/administration/workspaces#two-factor-authentication-2fa).

*Figure: 2FA is on with an authenticator app or a passkey.*

### Set up an authenticator app

1. Go to **Account → Two-Factor Authentication**
2. Click **Enable Two-Factor Authentication** (**Add an authenticator app** if you already have a passkey)
3. Scan the QR code with an authenticator app (Google Authenticator, Authy, 1Password, etc.) and click **Continue**
4. Enter the 6-digit code from the app and click **Verify & Enable**
5. Save your 10 **recovery codes**, then click **I've saved my codes**

This signs out your other devices.

> **Warning:** Each recovery code works once, and Qualflare shows the codes only once. If you lose your authenticator app or passkey, click **Use a recovery code** when you sign in. For a new set, click **Generate new codes** on this page. Your old codes then stop working.

*Figure: Save the recovery codes first.*

### Turn off the authenticator app

1. Go to **Account → Two-Factor Authentication**
2. Click **Disable Two-Factor Authentication** (**Turn off authenticator app** if you also have a passkey, which keeps two-factor authentication on)
3. Enter the current 6-digit code from your authenticator app and click **Disable Two-Factor Authentication**

This signs out your other devices. If a workspace you belong to requires two-factor authentication, you can turn off your authenticator app only if you have a passkey.

**Lost your authenticator app?** In the same dialog, click **Lost your authenticator?**. Enter a recovery code and click **Continue**, scan the new QR code, enter the new app's code, and click **Replace authenticator**. Then save your new recovery codes.

## Passkeys

A passkey is a second factor on its own: with one, two-factor authentication is on even without an authenticator app, and it meets a workspace's two-factor requirement. You confirm it with Face ID, Windows Hello, or a security key instead of typing a 6-digit code.

*Figure: Register up to 20 passkeys.*

### Add a passkey

1. Go to **Account → Passkeys**
2. Click **Add a passkey**, optionally name it, and click **Continue**
3. Follow your browser/OS prompt to create the passkey (Face ID, Touch ID, Windows Hello, or a hardware security key)
4. If this is your first second factor, save the recovery codes Qualflare shows, then click **I've saved my codes**

You can register up to 20 passkeys.

> **Note:** Passkeys require browser support (a modern browser on a device with biometric hardware or a security key). If your browser doesn't support them, the Passkeys page shows a notice and you'll continue using your authenticator app.

### Sign in with a passkey

Once you have a passkey registered, sign in as usual. On the two-factor step, your browser may offer your passkey, or you can click **Use a passkey**. Confirm it with your fingerprint, face, or security key.

*Figure: Choose Use a passkey on the two-factor step.*

### Remove a passkey

1. Go to **Account → Passkeys**
2. Click the trash icon next to the passkey you want to remove
3. Click **Verify with passkey**. If you have an authenticator app, you can instead click **Use an authenticator code instead**, enter the code, and click **Remove**.

You can't remove your last passkey unless you also have an authenticator app. Adding or removing a passkey signs out your other devices. To rename a passkey, click its pencil icon.

## Manage active sessions

1. Go to **Account → Sessions**
2. Your **Current Session** is listed first, then **Other Sessions**. Each shows its browser and operating system, the IP address it signed in from (and **Last seen from** when that changed), and when it signed in and was last active.
3. To end a session you don't recognize, click its trash icon, then **Revoke Session**. That device is signed out immediately.

A session ends after 30 days without use, and after 90 days in any case. An account holds at most 10 sessions: signing in on another device ends the oldest. A session from a single sign-on lasts as long as the workspace's [SSO session lifetime](https://docs.qualflare.com/docs/administration/sso#sso-session-lifetime).

> **Caution:** **Sign out everywhere** also revokes every access token you created, in every project, and disconnects any sign-in provider you linked since your oldest unexpired session signed in. CI pipelines that use your tokens stop working until you create new ones.

**Revoke All Other Sessions** ends every session except this one. **Sign out everywhere** ends all of them, this one included.

*Figure: Revoke a session you don't recognize, or sign out everywhere.*

## Connected accounts (OAuth)

You can connect GitHub or Google to sign in without a password. SSO links appear as separate rows, labeled **Single sign-on -** and the workspace name.

### Connect an account

1. Go to **Account → Connected Accounts**
2. Click **Connect** next to GitHub or Google
3. Complete the OAuth authorization flow
4. The provider is now linked — you can sign in using this account

### Disconnect an account

1. Go to **Account → Connected Accounts**
2. Click the trash icon next to the provider
3. Click **Disconnect** to confirm

Connecting or disconnecting a provider signs out your other devices.

> **Note:** Qualflare won't let you disconnect your only way to sign in ("Set a password or connect another sign-in method first"). Disconnecting an SSO link doesn't remove you from that workspace.

*Figure: Connect GitHub or Google to sign in without a password.*

## Change your password

1. Go to **Account → Update Password**
2. Enter your **Current Password**
3. Enter your **New Password** and **Confirm Password**
4. Click **Update Password**

This signs you out on every other device. Your access tokens keep working.

> **Caution:** Setting a password from a reset email signs you out everywhere, revokes every access token you created, in every project, and disconnects any sign-in provider you linked since your oldest unexpired session signed in. CI pipelines that use your tokens stop working until you create new ones.

Forgot it? Click **Forgot your current password?** to sign out and reset it by email. If you signed up with GitHub, Google, or SSO and have no password yet, click **Sign out and set a password**.

## New IP login alerts

Qualflare emails you when your account is signed in from a network it hasn't been used from in the last 30 days. If that wasn't you, change your password, revoke sessions you don't recognize, and check your second factors.

Qualflare also emails you about other security changes, such as a new password, second factor, passkey, connected account, or access token.

> **Caution:** Locking your account signs out every session, revokes every access token you created, in every project, cancels pending password-reset links, and disconnects sign-in providers linked during those sessions. Your password doesn't change, so reset it right away.

If an email has a **This wasn't me: lock my account** link and you didn't make the change, click it (it works once, for 7 days), click **Lock my account**, then click **Reset your password**.

## Troubleshoot

* "Set a password or connect another sign-in method first": set a password, or connect GitHub or Google, before you disconnect.
* Lost your authenticator app: use a recovery code ([see above](https://docs.qualflare.com/docs/administration/account-security#disabling-2fa)).
* **Confirm it’s you**: see [Before you begin](https://docs.qualflare.com/docs/administration/account-security#before-you-begin).

## Next steps

* [Single Sign-On](https://docs.qualflare.com/docs/administration/sso)
* [Require two-factor authentication](https://docs.qualflare.com/docs/administration/workspaces#two-factor-authentication-2fa)
* [Access tokens](https://docs.qualflare.com/docs/api/access-tokens) (sign out everywhere revokes them)
* [Roles and permissions](https://docs.qualflare.com/docs/administration/roles-permissions)