# Set up two-factor authentication and passkeys > Protect your account, verify a required sign-in, and manage your workspace's security requirement. Source: https://lira.thoughtly.com/docs/workspace/account-security Audience: everyone Last reviewed: 2026-10-24 An authenticator app adds a six-digit code to sign-in. A passkey lets you sign in with your fingerprint, face, screen lock, or security key. Your workspace can require two-factor authentication; either method meets that requirement. ## Open account security Open the workspace menu and choose **Your account**. Find **Account security** below your profile details. These methods belong to your account and protect it across your workspaces. Only you can enroll or remove your own methods. ![Account security showing an authenticator app that is not set up, a Set up button, and a Passkeys row with Add passkey.](https://lira.thoughtly.com/docs/images/product/account-security.webp) Set up an authenticator app or add a passkey from your account. ## Verify your email Before adding or removing a method, Lira opens **Verify your email**. Enter the six-digit code sent to your account email, then choose **Verify code**. Use **Send new code** if you need another email. The dialog closes when verification succeeds and the security change continues on the page. Choose **Cancel**, close the dialog, or press **Escape** to leave verification. ![Verify your email dialog with an empty Email verification code field, Send new code, Cancel, Verify code, and a close button.](https://lira.thoughtly.com/docs/images/product/security-email-verification.webp) Confirm your account email before adding or removing a security method. ## Set up an authenticator app 1. In **Authenticator app**, choose **Set up**. 2. Verify your email in the dialog. 3. Scan the QR code with your authenticator app, or enter the setup key in the app. 4. Enter the six-digit **Authenticator code** from the app and choose **Verify and enable**. Wait for **Your authenticator app is ready.** before leaving. The authenticator status changes to **On**. Keep the authenticator entry so you can retrieve codes when signing in. > **Keep setup details private** > > The QR code and setup key can give someone access to your authenticator codes. Never share them, include them in a screenshot, or send them to support. ## Add a passkey 1. In **Passkeys**, choose **Add passkey**. 2. Verify your email in the dialog. 3. Choose **Create passkey**, then follow your device or password manager's prompt. Wait for **Your passkey is ready.** and check that the passkey appears in the list. You can add more than one passkey. If you cancel the device prompt, you can choose **Create passkey** again or **Cancel** to leave setup. If you are completing required setup, adding the passkey takes you to **Verify this sign-in**. Choose **Sign in with a passkey** to use your new passkey before continuing. If Lira says your browser does not support passkeys, open it in a compatible browser. If either security method is unavailable, contact your workspace admin before changing anything. ## Verify a required sign-in The **Secure your account** screen appears when your workspace requires a method you have not set up, or your current sign-in still needs verification. Complete this screen before onboarding or returning to the workspace. ![Secure your account screen offering Use authenticator app and Sign in with a passkey, with Start again and Sign out below.](https://lira.thoughtly.com/docs/images/product/security-verification.webp) Verify this sign-in with an authenticator app or a passkey. If you have not enrolled a method, follow the setup steps on this screen. If you already have one, use **Use authenticator app**, enter its current code, and choose **Verify and continue**. Alternatively, choose **Sign in with a passkey** and complete the sign-in prompt. Either method meets the workspace's two-factor requirement. Signing in with a password or an email code alone does not satisfy a workspace's two-factor requirement. Adding a passkey also needs the separate passkey sign-in step. Switching workspaces can require verification. **Sign out** lets you return with a different account. Choose **Start again** to restart setup or verification. If an authenticator challenge expires, begin a new verification and enter the latest code from your app. ## Replace or remove a method Add and verify a replacement before removing a method you still need. Choose **Remove** beside the authenticator or passkey, review the confirmation, then verify your account email in the dialog to complete removal. Removing a method does not remove your workspace membership. If any of your active workspaces requires two-factor authentication, keep an authenticator app or at least one passkey. You can choose either method. Add a replacement before removing your last method. If no workspace requires two-factor authentication, you can choose which methods to keep. A disabled **Remove** control explains which required method you need to retain. An admin cannot enroll a personal method for you. ## Require security for a workspace Workspace admins can open **Settings → Security** and turn **Require two-factor authentication** on or off. Set up an authenticator app or a passkey on your own account before turning it on, then choose **Save changes**. ![Workspace Security settings with Require two-factor authentication switched on and Save changes below.](https://lira.thoughtly.com/docs/images/product/workspace-security.webp) Turn two-factor authentication on or off for every member, including admins. If the switch is disabled, follow **your account** to finish setting up an authenticator app or a passkey, then return to **Security**. Lira keeps the control unavailable until it confirms that your account has a method. If the enrollment check fails, review your account and reload the page after checking your connection. ![Workspace Security with the two-factor switch disabled and a First, add an authenticator app or a passkey in your account message linking to account settings.](https://lira.thoughtly.com/docs/images/product/workspace-security-disabled.webp) Set up a personal method before changing the workspace requirement. | Setting | What members need | | --- | --- | | Off | Each person decides whether to add an authenticator app or a passkey. | | On | An authenticator app or a verified passkey. Each person chooses their method. | The saved requirement applies to new and existing members, including admins. People complete setup or verification before they can enter the workspace. The requirement changes account access; it does not change roles or [practice privacy](https://lira.thoughtly.com/docs/workspace/privacy). If another admin changed the requirement while you were editing, refresh and review the current setting before saving again. If security is unavailable, follow the message to contact support. ## Recover from a problem For an incorrect authenticator code, use the latest six-digit code from the correct Lira entry. For an expired email verification, restart the change and request a new code. Wait before retrying if Lira reports too many attempts. If your email is verified but the next setup or removal request fails, choose **Continue** to retry the security change. If verification has expired, cancel and start again for a fresh code. If you lose a device, use another enrolled method that meets your workspace's requirement. If none is available, contact [help@thoughtly.com](mailto:help@thoughtly.com) from your account email. Never send passwords, verification codes, setup keys, QR codes, or security-key details. See [access troubleshooting](https://lira.thoughtly.com/docs/troubleshooting/access) for invitation and permission problems.