---
url: 'https://docs.smoxy.eu/account/two-factor-authentication.md'
---
# Two-Factor Authentication (2FA)

Two-factor authentication adds a second layer of security to your smoxy account: in addition to your password, signing in requires a time-based one-time code (TOTP) from an authenticator app. Every user can enable 2FA for their own account, and organization owners can [enforce it for all members](#organization-wide-enforcement).

***

### Enabling 2FA for Your Account

1. Open the **Account** page and find the **Two-factor authentication** card
2. Click **Enable two-factor authentication**
3. Scan the QR code with an authenticator app -- Google Authenticator, Authy, 1Password, or any TOTP app. Alternatively, enter the displayed key manually
4. Enter the 6-digit code from the app and click **Confirm**

2FA is now active: the next sign-in asks for a code from the authenticator app after the password.

### Recovery Codes

After enabling 2FA, smoxy shows a set of **recovery codes** -- store them somewhere safe (e.g. a password manager). Each code works exactly once and serves as a fallback when the authenticator app is unavailable. **They are only shown at this moment** and cannot be viewed again later.

New codes can be generated at any time via **Regenerate recovery codes** on the Account page; this invalidates the previous set.

### Disabling 2FA

2FA can be turned off from the same card via **Disable** -- confirming requires a current code from the authenticator app.

::: info
If an organization you belong to requires 2FA, it cannot be disabled. The card shows: "An organization you belong to requires 2FA, so it can't be disabled."
:::

***

### Organization-wide Enforcement

Organization owners can require 2FA for the whole team: on the [Team](/organization/team#require-2fa-for-all-members) page under **Security**, the **Require 2FA for all members** toggle enforces it. Members who don't yet have 2FA are prompted to set it up on their next sign-in and are blocked until they do.