> For the complete documentation index, see [llms.txt](https://docs.bugbug.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bugbug.io/your-account/two-factor-authentication.md).
# Two-factor authentication
Protect your BugBug account with two-factor authentication. Set up an authenticator app, sign in with a code and keep your recovery codes safe.
With two-factor authentication (2FA), signing in to BugBug takes one more step: after your password, or after signing in with Google, GitHub or Microsoft, you enter a 6-digit code from an authenticator app on your phone. Even if someone gets your password or one of those accounts, they can't get into BugBug without the code.
2FA is optional. You need an authenticator app such as Google Authenticator, Microsoft Authenticator, 1Password or Authy.
## Turn on 2FA
1. Click the person icon in the top right corner and choose **Account settings**.
2. Open the **Two-factor authentication** tab and click **Enable two-factor authentication**.
3. Scan the QR code with your authenticator app, or type the key shown under it.
4. Enter the 6-digit code from the app and click **Activate**.
Scan the QR code and enter the code from your app
5. Copy or download your recovery codes, store them somewhere safe and click **I saved my recovery codes**. BugBug shows them only once.
Recovery codes are shown only once
Turning on 2FA signs you out in your other browsers. The next time you sign in there, BugBug asks for a code.
{% hint style="info" %}
BugBug first asks for your password, even if you have just signed in. If you sign in only with Google, GitHub or Microsoft, it asks you to sign in again and come back to this tab within 5 minutes.
{% endhint %}
## Sign in with 2FA
Sign in as usual, then enter the code from your authenticator app and click **Verify**. This also applies when you sign in with Google, GitHub or Microsoft.
Enter the code from your authenticator app to finish signing in
The code changes every 30 seconds. If BugBug says it is incorrect, wait for the next one and check that the time on your phone is set automatically.
## Recovery codes
If you don't have your phone, click **Use a recovery code** on the code page and enter one of your saved codes. Each code works once, and BugBug emails you whenever one is used.
To get a new set, click **Generate new recovery codes** in **Account settings** > **Two-factor authentication** and confirm with a code from your authenticator app or one of your recovery codes. The old codes stop working right away.
## Turn off 2FA
In **Account settings** > **Two-factor authentication**, click **Disable two-factor authentication** and confirm with a code from your authenticator app. If you don't have your phone, use one of your recovery codes instead. Your password alone is not enough, so someone who knows it can't turn off 2FA.
BugBug emails you when 2FA is turned on or off and when new recovery codes are generated. If you didn't do it, reset your password and write to .
## Check who uses 2FA in your organization
Organization admins can see it in **Organization settings** > **Users**, in the **2FA** column. Other members don't see this column, and invited people who haven't created an account yet have no status.
## Lost your phone and your recovery codes
Write to from your account's email address. After we confirm your identity, we turn off 2FA after a waiting period (12 hours by default) and email you first, so you can stop it if you didn't ask for it.
Resetting your password does not turn off 2FA.
## FAQ
Does 2FA affect API tokens, the CLI or the MCP server?
API tokens keep working without a code, so CI pipelines are not affected. Connecting the CLI or the MCP server goes through BugBug in your browser, so you enter a code there if 2FA is on.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.bugbug.io/your-account/two-factor-authentication.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
