Two-factor authentication

Required account protection

Accounts with a password must enable an authenticator app (TOTP) before checkout, billing changes, reports and exports, sharing, API keys and MCP, bank or ledger connections, team changes, email or password changes, sender allowlist changes, and callback secrets. This also applies with a linked passkey or Google sign-in. Accounts without a password keep their existing protection rules. The free first look stays open: verify your email, sign in, upload or email in your first statement, review merchants and rules, preview My year and the locked report, view pricing, or edit your profile name. You can sign out or delete your account without TOTP; deletion keeps its existing identity check.

When a sensitive action asks you to protect your account, scan the QR code, enter the current 6-digit code, and save your backup codes. The action continues after setup, with any existing identity check still required. You can cancel and return to the free first look.

Turning it on

In Dashboard, open Settings, then Security. Confirm your password, then scan the QR code with an authenticator app (1Password, Authy, Google Authenticator, or any RFC 6238 TOTP app). Enter the 6-digit code it shows to confirm.

Backup codes

Once confirmed, you get 10 single-use backup codes, shown exactly once. Download them and store them somewhere safe: each one works once, if you lose access to your authenticator app.

Signing in with two-factor on

After verification with an authenticator code, backup code, or passkey, you return to your pending invitation or redemption page.

After your password, you're asked for a code (or a backup code, or a passkey, see below). A wrong code enough times in a row temporarily locks that check, separately from the account's own sign-in rate limit.

Trust this device

Checking "trust this device" at the challenge skips the second factor on that exact browser for up to 30 days. It's tied to the device, not the account: signing in from anywhere else still asks for it, and it never replaces the first factor (your password or another available sign-in method).

A passkey as the second factor

If you have a passkey registered (see /docs/passkeys), you can use it in place of a code at the two-factor challenge. A passkey requires your device's own biometric or PIN check, which this app treats as already satisfying two-factor assurance for that sign-in.

Turning it off

• Requires confirming your password.
• Requires a step-up check (a fresh password, code, passkey, email code for a passwordless account, or linked provider sign-in) if it's been a while since you last verified, see Sessions and devices.
• If your account has a password, sensitive actions are blocked again until you enable an authenticator app. The free first look remains available. API keys and MCP credentials created by your account are also blocked until TOTP is enabled again.
• You get an email the moment it's turned off, in case it wasn't you.