2FA
Authenticator (TOTP)
Local TOTP is optional on paper. We never recommend pairs. Secrets are not emailed. Passkeys and live step-up come later. Live writes stay locked.
Enroll
Signed-in desks generate a secret once at /desk/security. We do not enable until you verify a code.
Sign in
If 2FA is on, password-only sign-in asks for a code. A pending cookie cannot open the desk.
No SMS
No SMS. No email of the secret. Operator cannot read secrets.
Open desk 2FA · Sign in · Help