Two-factor authentication

Two-factor authentication (2FA) adds a second step at sign-in: a rotating six-digit code from an authenticator app, on top of your password. MentionFlow uses time-based one-time passwords (TOTP) with one-time backup codes.

What it does

With 2FA enabled, signing in requires both your password and a current code from your authenticator app. If you ever lose the device, one-time backup codes let you back in. 2FA is opt-in per user and set up from your account page.

How to use it

Enable it from your account:

1. Confirm your password to begin.
2. Scan the QR code with any authenticator app (for example 1Password, Google Authenticator, or Authy).
3. Enter one code the app shows to finish. 2FA is not active until this code verifies.
4. Save your backup codes. They are shown once, at enrollment, and each one works a single time.

To turn 2FA off, confirm your password again.

After 2FA is on, sign-in for your account is challenged at /two-factor, where you enter a current authenticator code (or a backup code) to continue.

How it's computed / enforced

Enrollment is verify-first: enabling generates the TOTP secret and backup codes, but 2FA does not switch on until you enter one valid code. A misconfigured authenticator therefore cannot lock you out, because the setup fails before it takes effect rather than after.

Both enabling and disabling require re-entering your password, so someone with a live session but not your password cannot change your 2FA state. Each backup code is single-use.

Limits

• No plan gate — 2FA is available on every plan.
• 2FA is per user, not per workspace; each member enables it on their own account.
• Backup codes are shown once and each is usable a single time.

Related

• Workspace and members — roles and access across the team.
• Manage 2FA in-app on your account.