# Two-factor sign-in

> Add a code from an authenticator app to every Milvao sign-in. It's optional for community teams and recommended for anyone who manages members.

Source: https://milvao.com/help/getting-started/two-factor-sign-in · Updated 2026-11-06

## Key takeaways

- Two-factor sign-in asks for a 6-digit code from an authenticator app each time you sign in.
- Set it up from your name at the bottom of the sidebar, then Security and two-factor.
- Save your backup codes when they're shown. Each works once, and they aren't shown again.
- It's optional for everyone. Until it's on, a reminder appears after you sign in; **Set up later** hides it for 30 days.
- You get an email whenever two-factor is turned on or off, or new backup codes are made, so you notice a change you didn't make.

Two-factor sign-in protects your account even if someone learns your password. After your password, Milvao asks for a 6-digit code that only your phone can produce. It is optional, and Milvao never makes you set it up before you can sign in. Until it's on, a short reminder appears at the top of the app with **Set it up** and **Set up later** (which hides it for 30 days on that browser). We recommend it for everyone who can see member profiles.

You need an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator, 1Password or Authy.

## Turn it on

Confirm your email address first: open the link in your sign-up email, or accept your team invite. Until then the set-up is refused, so nobody who used your address before you can lock the account with their phone.

1. Click your name at the bottom of the sidebar, then **Security and two-factor**.
2. On the **Two-factor sign-in** card, enter your **Password** and click **Set up two-factor sign-in**.
3. Open your authenticator app, add an account, and scan the QR code. Can't scan? Type in the key shown under **Can't scan? Key:** instead.
4. Enter the 6-digit **Code** your app shows and click **Turn on**.
5. You see **Two-factor sign-in is on** and a list of backup codes. Click **Copy codes** and keep them somewhere safe, such as a password manager.

> [!IMPORTANT]
> Backup codes are shown only once. If you lose your phone and your backup codes, you can't sign in until Milvao helps you.

## Sign in with it

1. Sign in with your email and password as usual.
2. On the **Two-factor sign-in** page, enter the 6-digit **Code** from your app and click **Verify**.

### Use a backup code

If you don't have your phone, click **Use a backup code**, enter one of your saved codes and click **Verify**. Each backup code works once. To go back to the app, click **Use the authenticator app instead**.

## Turn it off

1. Click your name at the bottom of the sidebar, then **Security and two-factor**.
2. Enter your **Password** and click **Turn off**.

## Emails about your account

Milvao emails you when two-factor sign-in is turned on or off, when new backup codes are made, and when your password changes. If you didn't make the change, reset your password from **Forgot password** on the sign-in page and write to hello@milvao.com straight away.

If you reset your password before you ever confirmed your email address, any two-factor set-up on the account is removed, because the reset link proves the inbox is yours. Set it up again afterwards.

## For Milvao staff: codes for sensitive actions

Milvao's own staff are asked for a fresh code during sensitive actions in the admin panel, even right after signing in: viewing your workspace as an operator (only while you've granted support access), creating or rotating admin API tokens, changing staff roles, adding an owner to a workspace that already has one, and removing a workspace owner. One code covers those actions for 10 minutes in that browser. Staff can't add themselves to your team: an owner invite or owner removal made by Milvao staff emails every owner of the workspace, so you always know.

## Troubleshooting

| What happens | What to do |
|---|---|
| **Confirm your email address first** when you set it up | Open the link in your sign-up email or accept your team invite, then try again |
| **Too many codes tried** | Wait 10 minutes. Each account can try a limited number of codes |
| The code doesn't work | Codes change every 30 seconds and depend on your phone's clock. Set the clock to automatic, wait for a fresh code and try again |
| **6 digits** under the field | Enter only the 6 numbers, without spaces |
| You got a new phone | Before you switch, sign in on the old phone's app, turn two-factor off and set it up again on the new phone. Some apps can also move accounts between phones |
| You lost your phone | Sign in with a backup code, then turn two-factor off and set it up again on your new phone |
| You lost your phone and your backup codes | Email hello@milvao.com from the address on your account |

## Frequently asked questions

### Does my whole team have to use it?
No. Each person chooses for their own account, and nobody is blocked from signing in without it.

### Can I use SMS codes instead?
No. Milvao uses authenticator apps only, which are safer than SMS.