Account Security

Secure your Qualflare account with two-factor authentication, session management, connected OAuth accounts, password management, and SSO for Enterprise workspaces.

Account Security

Qualflare provides several tools to keep your account secure. This guide covers setting up two-factor authentication, managing active sessions, and connecting or disconnecting OAuth accounts.

If your workspace requires SSO (Enterprise plan), you sign in through your organization's identity provider instead of a Qualflare password. The two-factor, passkey, and password sections below won't apply to you — enabling Require SSO for all members disables password and social sign-in workspace-wide, including for owners.

Setting up or managing an SSO connection is a workspace-admin task, not an individual account setting. See SSO & SCIM Provisioning for how workspace admins connect an identity provider, verify domains, and enforce SSO.

Two-Factor Authentication (2FA)

Two-factor authentication adds a second verification step to your login, requiring a code from an authenticator app in addition to your password.

Setting Up 2FA

Go to Account → Two-Factor Authentication
Click Enable 2FA
Scan the QR code with an authenticator app (Google Authenticator, Authy, 1Password, etc.)
Enter the 6-digit code shown in your authenticator app to confirm setup
Save your recovery codes in a secure location

Recovery codes are used to regain access if you lose your authenticator device. Store them in a secure place — they cannot be retrieved later.

Disabling 2FA

Go to Account → Two-Factor Authentication
Click Disable 2FA
Enter your current password and a verification code to confirm

Passkeys

A passkey lets you complete the second-factor step at login with Face ID, Windows Hello, or a security key instead of typing a 6-digit code from your authenticator app.

Adding a Passkey

Go to Account → Passkeys
Click Add a passkey
Follow your browser/OS prompt to create the passkey (Face ID, Touch ID, Windows Hello, or a hardware security key)

You can add more than one passkey — useful if you sign in from multiple devices.

Passkeys require browser support (a modern browser on a device with biometric hardware or a security key). If your browser doesn't support them, the Passkeys page shows a notice and you'll continue using your authenticator app.

Signing In With a Passkey

Once you have a passkey registered, sign in as usual with your email and password. On the two-factor step, your browser automatically offers your passkey (via a native autofill-style prompt) as an alternative to typing a code — confirm it with your fingerprint, face, or security key instead of entering the 6-digit code.

Removing a Passkey

Go to Account → Passkeys
Click the delete icon next to the passkey you want to remove
Confirm removal — depending on your workspace's security settings, this may require a fresh passkey tap or TOTP code to confirm

Managing Active Sessions

View and manage all active login sessions for your account.

Go to Account → Sessions
The list shows each session with:
- Device/browser type
- IP address
- Location (approximate)
- Last active time
Click Revoke on any session you don't recognize or no longer need

Revoking a session immediately signs out that device. Use this if you suspect unauthorized access or if you lost a logged-in device.

Connected Accounts (OAuth)

You can connect social/OAuth login providers to sign in without a password.

Connecting an Account

Go to Account → Connected Accounts
Click Connect next to the provider you want to add (Google, GitHub, etc.)
Complete the OAuth authorization flow
The provider is now linked — you can sign in using this account

Disconnecting an Account

Go to Account → Connected Accounts
Click Disconnect next to the provider
Confirm the disconnection

Make sure you have a password set or another connected account before disconnecting — otherwise you may lose access to your account.

Changing Your Password

Go to Account → Update Password
Enter your current password
Enter and confirm your new password
Click Update

Qualflare sends an email alert when your account is signed in from a new or unrecognized IP address. If you receive this email and don't recognize the login, change your password immediately and revoke the session.

Account Security