Two-Factor Authentication
Last updated on August 14, 2026
Two-factor authentication (2FA) adds a second check on top of email or SSO login. Every member manages their own factors; enforcing 2FA organization-wide requires the Owner role.
Two factor types are supported, and either one alone is enough:
- Passkeys: WebAuthn backed by laptop biometrics, phone, or hardware key (YubiKey).
- Authenticator apps: TOTP from 1Password, Google Authenticator, Authy.
Enable 2FA
Open Settings > Authentication.
Click Enable in the Two-factor authentication card.
Pick a factor type.
Save the recovery codes offline.
Set up a passkey
You can register more than one passkey for the same account.
Click Add passkey under Settings > Authentication.
Pick a credential source: current device, phone via QR, or hardware key.
Follow the system prompt (Touch ID, Windows Hello, YubiKey tap).
Name the passkey (MacBook Pro, YubiKey 5, iPhone 15) so you can revoke it later.
Set up an authenticator app
Click Add authenticator app under Settings > Authentication.
Scan the QR code, or paste the secret manually.
Enter the six-digit code to confirm pairing.
Every sign-in prompts for a fresh code.
Recovery codes
Recovery codes bypass 2FA, and each code is single-use.
Open Settings > Authentication > Two-factor authentication.
Click Generate new recovery codes.
Save the new codes offline.
Generating a new set invalidates the old codes.
Enforce 2FA organization-wide
Open Settings > Organization > Security.
Toggle Require two-factor authentication for all members.
Members without 2FA enroll on their next sign-in before they can access data. SSO members satisfy enforcement when their IdP requires 2FA upstream, because the check reads the SSO assertion.
Lose your second factor
Owners reset a member's 2FA under Settings > Members > Reset 2FA, and the member re-enrolls on their next sign-in.
If you are the only Owner and locked out, contact support@tofupilot.com.
How is this guide?
SCIM Provisioning
Learn how to sync members and groups from your identity provider to TofuPilot with SCIM, so account lifecycle stays in your directory.
API Keys
Learn how to authenticate scripts, factory stations, and CI runs with TofuPilot API keys, including how user and station keys differ in scope.