# Two-factor authentication

Two-factor authentication adds a code from your phone to your password. Turn it on — your Workover account can publish to your live website, which makes it worth more to an attacker than most accounts.

## Turning it on

Account settings → **Security** → enable two-factor.

1. Workover shows a QR code. Scan it with an authenticator app — 1Password, Authy, Google Authenticator, or your password manager.
2. Enter the six-digit code it generates, to prove it worked.
3. **Save your recovery codes.** This is the step people skip.

From then on, signing in asks for a code after your password.

## Recovery codes

One-time codes that get you in when you cannot reach your authenticator — phone lost, stolen, wiped, or replaced without moving your accounts across.

Store them somewhere that is **not** the phone with the authenticator on it. A password manager is the obvious place; a screenshot in your camera roll is not.

Each works once. Generate a fresh set when you run low, which invalidates the old ones.

## Losing access

With a recovery code, sign in and re-enrol a new device.

Without one, contact support. We will verify who you are before turning it off, and that verification is deliberately slow — an account-recovery process an attacker can talk their way through is worse than no second factor at all.

## Turning it off

You can, from the same settings, by confirming a current code. If your workspace requires two-factor you will not be able to.

## What it does not protect

Two-factor protects your **Workover** account. It does not protect your WordPress site — that has its own login and needs its own second factor. And it does not affect the application password Workover uses to talk to WordPress, which is a separate credential you can revoke from wp-admin at any time.

## Tokens

CLI and MCP tokens authenticate on their own and do not prompt for a code — that is why they are scoped, and why account security is never reachable from one. Review them under **Developer** and revoke anything unfamiliar.

## Related

- [Your profile](/docs/your-profile)
- [The CLI and MCP server](/docs/cli-and-mcp)
- [Contacting support](/docs/contacting-support)