# Two-factor authentication > Two-factor authentication (2FA) adds a second step to signing in, so your account is safe even if your password is stolen. Source: https://infranest.io/docs/two-factor-authentication Last updated: 2026-10-26 --- Two-factor authentication keeps your account safe even if someone gets hold of your password, by asking for a second proof that it's really you. ## Overview - Two-factor authentication (2FA) adds a second step to signing in. - You can use **passkeys** (fingerprint, face, phone or a security key) or an **authenticator app** (a 6-digit code that changes every 30 seconds) — either one satisfies 2FA. - Passkeys are the safer choice, since they only work on the real InfraNest site and can't be phished. ## Which should I choose? **Passkeys** use your fingerprint, face, phone or a hardware security key. They're the safer choice: a passkey only works on the real InfraNest site, so a fake sign-in page can't trick you into handing it over. Nothing to type, and nothing to copy. **An authenticator app** shows a 6-digit code that changes every 30 seconds. Choose this if you'd rather not use passkeys, or if your device doesn't support them. It comes with recovery codes you can fall back on. ## Set up passkeys 1. Go to **My account → Sign-in & security → Passkeys** and choose **Add a passkey**. 2. Confirm with your fingerprint, face, device PIN or security key when your browser asks. 3. Choose **Add a second passkey**, on a different device or a hardware key. ![Two-factor authentication](/media/545ddac3-b79f-43dc-a7a0-078b67237cc0) Two, not one — a single passkey has no backup, so if you lost that device you'd be locked out. That's also why one passkey on its own doesn't meet a 2FA requirement: you need two of them, or one passkey plus an authenticator app. ### Synced, or this device only? Each passkey in the list says which it is. - **Synced** — it's copied to your other devices through iCloud Keychain, a password manager or your Google account. Convenient, and losing one device doesn't lose the passkey. - **This device only** — it can't leave the device or security key it was made on. Safer, because there's no copy anywhere for anyone to reach — but if you lose that device, that passkey is gone with it. It's worth knowing which you have before you decide your second one. Two **synced** passkeys from the same account are a convenience rather than a real backup: they live in the same place, so whatever you'd lose one to, you'd probably lose both. Pairing a synced passkey with a **this device only** hardware key is the stronger combination. > [!NOTE] > A passkey added before InfraNest started recording this won't say either way. Nothing is wrong with it — we simply don't know, and we'd rather say nothing than guess. ## Set up an authenticator app 1. Go to **My account → Sign-in & security** and start **two-factor authentication** setup. 2. Scan the **QR code** with an authenticator app (like Google Authenticator or 1Password). 3. Enter a code from the app to confirm, then **save your recovery codes** somewhere safe — **Download codes** saves them as a text file. From now on, you'll enter a code from your app each time you sign in. > [!WARNING] > Keep your **recovery codes** — they're the only way back in if you lose your authenticator, and they're shown only once. ## If you lose your device 1. If you use an authenticator app, use one of your **recovery codes** in place of the app code when signing in. 2. If you use passkeys, sign in with your other passkey — then add a replacement for the one you lost. 3. If you're locked out completely, an organisation admin can help. ## If 2FA is required for you Your organisation (or the platform) may **require** 2FA. If so, you'll be asked to set it up before you can continue, and you can choose either method on that screen. Once a requirement applies to you, InfraNest won't let you remove the last thing satisfying it — so if passkeys are all you have, removing one is refused until you've set up an authenticator app or registered another passkey. That's deliberate: otherwise the removal would succeed and lock you out of the app a moment later. **Signing in through your organization's own identity provider** (such as Okta or Microsoft Entra ID) counts as two-factor for that organization: your provider already asked for it. You are not asked to set up an authenticator app in InfraNest as well. This applies only to organizations that require two-factor themselves, and only when you signed in through *their* provider. Signing in with Google, GitHub or Microsoft does not count, and neither does a password.