Skip to main content

​
Two-factor authentication and sessions

Add a second factor to your PromptGuard account so that a password, an emailed sign-in code or a Google or GitHub account is not enough on its own to sign in. Organization admins can require it of everyone.

​
What counts as a second factor

  • An authenticator app, such as 1Password, Google Authenticator, Microsoft Authenticator or Authy. It shows a six-digit code that changes every 30 seconds.
  • A passkey: your device’s built-in authenticator (Touch ID, Windows Hello, an Android or iPhone screen lock) or a security key.
  • Recovery codes: ten one-time codes you get when you set up your first factor, for when you lose your phone or key.
Once you have a second factor, PromptGuard asks for it every time you sign in with a password, an emailed code, Google or GitHub. If you sign in through your organization’s single sign-on, PromptGuard does not ask: your identity provider is where your second factor is checked.

​
Set up an authenticator app

  1. Go to Account in the dashboard and find Two-factor authentication.
  2. Next to Authenticator app, select Set up.
  3. In your authenticator app, add an account and enter the key PromptGuard shows. On a phone, you can select open it in the app instead.
  4. Enter the six-digit code your app shows, and select Turn on.
  5. Save the ten recovery codes somewhere safe, such as your password manager. They are shown only once.

​
Add a passkey

  1. On Account, under Passkeys, give the passkey a name you will recognize, such as “Work laptop”.
  2. Select Add a passkey and follow your browser’s prompt.
You can add more than one passkey. If it is your first second factor, you get recovery codes as well.

​
Sign in with a second factor

After your password, emailed code or Google or GitHub sign-in, PromptGuard asks for your second factor. Enter the code from your authenticator app, enter a recovery code, or select Use a passkey. Each code works once. If you enter five wrong codes, or take longer than five minutes, start signing in again. Wrong codes count toward the account lockout, as wrong passwords do: five in a row lock the account for 15 minutes. Adding or removing a second factor signs you out on every other browser and device.

​
Lost your authenticator?

Sign in and enter one of your recovery codes instead of an authenticator code. Each recovery code works once. Then, on Account, remove the lost authenticator or passkey and set up a new one, or select Make new codes to replace your recovery codes. Removing a factor or making new recovery codes asks you to prove a factor you still have, there and then: a current code from your authenticator app, a recovery code, or your passkey. A wrong code counts toward the account lockout. If you have no recovery codes left and no working factor, contact support from the address you sign in with. We remove your second factor 72 hours after replying to that address, and you can cancel by answering that email. If you belong to an organization that requires two-factor authentication, one of its owners confirms it is you first.

​
Require two-factor authentication in your organization

Organization admins can require every member to use a second factor or single sign-on:
  1. Set up your own second factor first, and sign in with it.
  2. On Settings → Team, check who has one: each member shows Two-factor: yes or no.
  3. Go to Settings → Security and turn on Require two-factor authentication or SSO. The confirmation says how many members it will stop: those with no second factor, leaving out anyone whose email domain can only sign in through SSO.
An admin can turn it on; only an owner can turn it off; either has to be signed in with a second factor or SSO to change it. A managed service provider acting for your organization can do neither. A personal organization does not have the setting: set up your own second factor instead. Every change is recorded in the audit log. From then on, a member who signed in without a second factor or SSO is taken to their Account page to set one up, and cannot see or change anything in that organization until they have. They can still sign out, switch to another organization, and use their own personal organization. Setting up a factor lets them in straight away. API keys and the Shadow AI desktop agent are not affected: they do not sign in to the dashboard.

​
Signing out

  • Sign out ends the session on that browser immediately, on every PromptGuard server.
  • Changing your password signs you out on every other browser and device, and keeps you signed in where you made the change.
  • Resetting a forgotten password signs you out everywhere.
  • Sign out everywhere, on Account under Sessions, ends every session you hold, including the one you are using.

​
Next steps

Last modified on November 1, 2026