Two-factor authentication

Two-factor authentication adds a code from your phone to your password. Turn it on — your Workover account can publish to your live website, which makes it worth more to an attacker than most accounts.

Turning it on

Account settings → Security → enable two-factor.

Workover shows a QR code. Scan it with an authenticator app — 1Password, Authy, Google Authenticator, or your password manager.
Enter the six-digit code it generates, to prove it worked.
Save your recovery codes. This is the step people skip.

From then on, signing in asks for a code after your password.

Recovery codes

One-time codes that get you in when you cannot reach your authenticator — phone lost, stolen, wiped, or replaced without moving your accounts across.

Store them somewhere that is not the phone with the authenticator on it. A password manager is the obvious place; a screenshot in your camera roll is not.

Each works once. Generate a fresh set when you run low, which invalidates the old ones.

Losing access

With a recovery code, sign in and re-enrol a new device.

Without one, contact support. We will verify who you are before turning it off, and that verification is deliberately slow — an account-recovery process an attacker can talk their way through is worse than no second factor at all.

Turning it off

You can, from the same settings, by confirming a current code. If your workspace requires two-factor you will not be able to.

What it does not protect

Two-factor protects your Workover account. It does not protect your WordPress site — that has its own login and needs its own second factor. And it does not affect the application password Workover uses to talk to WordPress, which is a separate credential you can revoke from wp-admin at any time.

Tokens

CLI and MCP tokens authenticate on their own and do not prompt for a code — that is why they are scoped, and why account security is never reachable from one. Review them under Developer and revoke anything unfamiliar.