Two-factor authentication

Two-factor authentication means a password alone isn't enough to sign in. After your password, you enter a six-digit code from an authenticator app on your phone. Your workspace holds your clients' documents, so it's worth turning on for everyone, and the workspace owner can require it.

Turn it on for yourself#

You'll need an authenticator app on your phone. Any app that supports TOTP codes works, such as Google Authenticator, Microsoft Authenticator or 1Password.

1. Go to Settings → Security.
2. Under Two-factor authentication, click Enable 2FA. You may be asked to confirm your password.
3. Scan the QR code with your authenticator app. If you can't scan it, enter the setup key shown instead.
4. Click Continue.
5. Enter the 6-digit code from your authenticator app and confirm.

From then on, each time you sign in you're asked for a code from the app after your password. Turning it on also signs out every other browser on your account, including any that were remembered, since they signed in with a password alone. The browser you're using stays signed in.

Save your recovery codes#

Recovery codes let you get back into your account if you lose your phone. Once two-factor authentication is on:

1. On Settings → Security, under 2FA recovery codes, click View recovery codes.
2. Save them in a secure password manager.

Each code works once and is removed after use. To get a fresh set, click Regenerate codes and confirm. Your old codes stop working.

To sign in with a recovery code, choose login using a recovery code on the sign-in code screen and enter one.

If you've lost both your phone and your recovery codes, write to hello@cartenda.com.

Turn it off#

On Settings → Security, click Disable 2FA and confirm. If your workspace requires two-factor authentication, you'll be asked to set it up again before you can keep working there.

Passkeys are different#

Settings → Security also lets you add passkeys. A passkey is a convenient and secure way to sign in, but it replaces your password rather than adding a step after it. So a passkey on its own doesn't count as two-factor authentication. If your workspace requires two-factor authentication, you still need an authenticator app.

Add a passkey#

1. Go to Settings → Security.
2. Under Passkeys, click Add a passkey.
3. Give it a Passkey name, such as the device it's on, and click Register passkey.
4. Confirm with your fingerprint, face or device PIN when your browser asks.

Add one on each device you sign in from. To remove one, click the trash icon beside it and confirm with Remove passkey. Removing a passkey signs out every other browser on your account, including any that signed in with it or were remembered, so a passkey you don't recognize loses its way in at once. The browser you're using stays signed in.

Require it for your whole firm#

The workspace owner can require two-factor authentication for everyone:

1. Set it up for yourself first, under Settings → Security.
2. Go to Settings → General.
3. Under Two-factor sign-in, turn on Require two-factor authentication for everyone.
4. Click Save.

The page tells you how many members don't use it yet. Once it's required, they're asked to set it up the next time they open a page in your workspace, and they can't keep working there until they do. Anyone who would rather not set it up can still leave the workspace.

To stop requiring it, turn the switch off and save.

Who can do what#

Everyone turns two-factor authentication on or off for their own account. Only the workspace owner can require it for the firm, because it decides who can keep working in the workspace at all.

To see what each role can do, see Inviting your team.