> ## Documentation Index > Fetch the complete documentation index at: https://docs.promptguard.co/llms.txt > Use this file to discover all available pages before exploring further. # Two-factor authentication and sessions > Protect your PromptGuard sign-in with an authenticator app or a passkey, require it across your organization, and sign out everywhere # Two-factor authentication and sessions Add a second factor to your PromptGuard account so that a password, an emailed sign-in code or a Google or GitHub account is not enough on its own to sign in. Organization admins can require it of everyone. ## What counts as a second factor * **An authenticator app**, such as 1Password, Google Authenticator, Microsoft Authenticator or Authy. It shows a six-digit code that changes every 30 seconds. * **A passkey**: your device's built-in authenticator (Touch ID, Windows Hello, an Android or iPhone screen lock) or a security key. * **Recovery codes**: ten one-time codes you get when you set up your first factor, for when you lose your phone or key. Once you have a second factor, PromptGuard asks for it every time you sign in with a password, an emailed code, Google or GitHub. If you sign in through your organization's [single sign-on](https://docs.promptguard.co/platform/sso.md), PromptGuard does not ask: your identity provider is where your second factor is checked. ## Set up an authenticator app 1. Go to **Account** in the dashboard and find **Two-factor authentication**. 2. Next to **Authenticator app**, select **Set up**. 3. In your authenticator app, add an account and enter the key PromptGuard shows. On a phone, you can select **open it in the app** instead. 4. Enter the six-digit code your app shows, and select **Turn on**. 5. Save the ten recovery codes somewhere safe, such as your password manager. They are shown only once. ## Add a passkey 1. On **Account**, under **Passkeys**, give the passkey a name you will recognize, such as "Work laptop". 2. Select **Add a passkey** and follow your browser's prompt. You can add more than one passkey. If it is your first second factor, you get recovery codes as well. ## Sign in with a second factor After your password, emailed code or Google or GitHub sign-in, PromptGuard asks for your second factor. Enter the code from your authenticator app, enter a recovery code, or select **Use a passkey**. Each code works once. If you enter five wrong codes, or take longer than five minutes, start signing in again. Wrong codes count toward the account lockout, as wrong passwords do: five in a row lock the account for 15 minutes. Adding or removing a second factor signs you out on every other browser and device. ## Lost your authenticator? Sign in and enter one of your recovery codes instead of an authenticator code. Each recovery code works once. Then, on **Account**, remove the lost authenticator or passkey and set up a new one, or select **Make new codes** to replace your recovery codes. Removing a factor or making new recovery codes asks you to prove a factor you still have, there and then: a current code from your authenticator app, a recovery code, or your passkey. A wrong code counts toward the account lockout. If you have no recovery codes left and no working factor, [contact support](mailto:support@promptguard.co) from the address you sign in with. We remove your second factor 72 hours after replying to that address, and you can cancel by answering that email. If you belong to an organization that requires two-factor authentication, one of its owners confirms it is you first. ## Require two-factor authentication in your organization Organization admins can require every member to use a second factor or single sign-on: 1. Set up your own second factor first, and sign in with it. 2. On **Settings** → **Team**, check who has one: each member shows **Two-factor: yes** or **no**. 3. Go to **Settings** → **Security** and turn on **Require two-factor authentication or SSO**. The confirmation says how many members it will stop: those with no second factor, leaving out anyone whose email domain can only sign in through SSO. An admin can turn it on; only an owner can turn it off; either has to be signed in with a second factor or SSO to change it. A managed service provider acting for your organization can do neither. A personal organization does not have the setting: set up your own second factor instead. Every change is recorded in the [audit log](https://docs.promptguard.co/platform/audit-logs.md). From then on, a member who signed in without a second factor or SSO is taken to their **Account** page to set one up, and cannot see or change anything in that organization until they have. They can still sign out, switch to another organization, and use their own personal organization. Setting up a factor lets them in straight away. API keys and the Shadow AI desktop agent are not affected: they do not sign in to the dashboard. ## Signing out * **Sign out** ends the session on that browser immediately, on every PromptGuard server. * **Changing your password** signs you out on every other browser and device, and keeps you signed in where you made the change. * **Resetting a forgotten password** signs you out everywhere. * **Sign out everywhere**, on **Account** under **Sessions**, ends every session you hold, including the one you are using. ## Next steps * [Set up single sign-on](https://docs.promptguard.co/platform/sso.md), so your team signs in through your identity provider. * [Manage your organization](https://docs.promptguard.co/platform/organizations.md): members, roles and settings. * [Read the audit log](https://docs.promptguard.co/platform/audit-logs.md) to see who signed in and what changed. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.