Set up two-factor authentication and passkeys
Protect your account, verify a required sign-in, and manage your workspace's security requirement.
On this page
An authenticator app adds a six-digit code to sign-in. A passkey lets you sign in with your fingerprint, face, screen lock, or security key. Your workspace can require two-factor authentication; either method meets that requirement.
Open account security
Open the workspace menu and choose Your account. Find Account security below your profile details. These methods belong to your account and protect it across your workspaces. Only you can enroll or remove your own methods.
Verify your email
Before adding or removing a method, Lira opens Verify your email. Enter the six-digit code sent to your account email, then choose Verify code. Use Send new code if you need another email.
The dialog closes when verification succeeds and the security change continues on the page. Choose Cancel, close the dialog, or press Escape to leave verification.
Set up an authenticator app
- In Authenticator app, choose Set up.
- Verify your email in the dialog.
- Scan the QR code with your authenticator app, or enter the setup key in the app.
- Enter the six-digit Authenticator code from the app and choose Verify and enable.
Wait for Your authenticator app is ready. before leaving. The authenticator status changes to On. Keep the authenticator entry so you can retrieve codes when signing in.
Keep setup details private
The QR code and setup key can give someone access to your authenticator codes. Never share them, include them in a screenshot, or send them to support.
Add a passkey
- In Passkeys, choose Add passkey.
- Verify your email in the dialog.
- Choose Create passkey, then follow your device or password manager's prompt.
Wait for Your passkey is ready. and check that the passkey appears in the list. You can add more than one passkey. If you cancel the device prompt, you can choose Create passkey again or Cancel to leave setup.
If you are completing required setup, adding the passkey takes you to Verify this sign-in. Choose Sign in with a passkey to use your new passkey before continuing.
If Lira says your browser does not support passkeys, open it in a compatible browser. If either security method is unavailable, contact your workspace admin before changing anything.
Verify a required sign-in
The Secure your account screen appears when your workspace requires a method you have not set up, or your current sign-in still needs verification. Complete this screen before onboarding or returning to the workspace.
If you have not enrolled a method, follow the setup steps on this screen. If you already have one, use Use authenticator app, enter its current code, and choose Verify and continue. Alternatively, choose Sign in with a passkey and complete the sign-in prompt. Either method meets the workspace's two-factor requirement.
Signing in with a password or an email code alone does not satisfy a workspace's two-factor requirement. Adding a passkey also needs the separate passkey sign-in step. Switching workspaces can require verification. Sign out lets you return with a different account.
Choose Start again to restart setup or verification. If an authenticator challenge expires, begin a new verification and enter the latest code from your app.
Replace or remove a method
Add and verify a replacement before removing a method you still need. Choose Remove beside the authenticator or passkey, review the confirmation, then verify your account email in the dialog to complete removal. Removing a method does not remove your workspace membership.
If any of your active workspaces requires two-factor authentication, keep an authenticator app or at least one passkey. You can choose either method. Add a replacement before removing your last method.
If no workspace requires two-factor authentication, you can choose which methods to keep.
A disabled Remove control explains which required method you need to retain. An admin cannot enroll a personal method for you.
Require security for a workspace
Workspace admins can open Settings → Security and turn Require two-factor authentication on or off. Set up an authenticator app or a passkey on your own account before turning it on, then choose Save changes.
If the switch is disabled, follow your account to finish setting up an authenticator app or a passkey, then return to Security. Lira keeps the control unavailable until it confirms that your account has a method. If the enrollment check fails, review your account and reload the page after checking your connection.
| Setting | What members need |
|---|---|
| Off | Each person decides whether to add an authenticator app or a passkey. |
| On | An authenticator app or a verified passkey. Each person chooses their method. |
The saved requirement applies to new and existing members, including admins. People complete setup or verification before they can enter the workspace. The requirement changes account access; it does not change roles or practice privacy.
If another admin changed the requirement while you were editing, refresh and review the current setting before saving again. If security is unavailable, follow the message to contact support.
Recover from a problem
For an incorrect authenticator code, use the latest six-digit code from the correct Lira entry. For an expired email verification, restart the change and request a new code. Wait before retrying if Lira reports too many attempts.
If your email is verified but the next setup or removal request fails, choose Continue to retry the security change. If verification has expired, cancel and start again for a fresh code.
If you lose a device, use another enrolled method that meets your workspace's requirement. If none is available, contact help@thoughtly.com from your account email. Never send passwords, verification codes, setup keys, QR codes, or security-key details. See access troubleshooting for invitation and permission problems.