Skip to main content
Two-factor authentication (2FA) requires a one-time code from an authenticator app each time you sign in. ShingleAI uses TOTP (time-based one-time passwords), the same standard used by Google Authenticator, 1Password, Authy, and most other authenticator apps.

​
Prerequisites

  • A signed-in ShingleAI account with email-and-password sign-in (your password is required to enable 2FA)
  • An authenticator app installed on your phone or password manager

​
Enable two-factor authentication

  1. Navigate to Settings > User > Security
  2. In the Two-factor authentication card, click Enable two-factor authentication
  3. Enter your current password to confirm
  4. Scan the displayed QR code with your authenticator app — or enter the secret manually if you can’t scan
  5. Enter the 6-digit code your app generates to verify the setup
  6. Save the backup codes displayed on the next screen, then click Done
Backup codes are shown only once. Save them in a password manager or other secure location before clicking Done. You’ll need them if you ever lose access to your authenticator app.

​
Backup codes

Each backup code can be used once in place of a TOTP code. Use them when you don’t have your authenticator app handy — for example, after losing or wiping a phone. To generate a fresh set:
  1. In the Two-factor authentication card, click Regenerate backup codes
  2. Enter your current password
  3. Save the new codes — the previous set is invalidated immediately

​
Sign in with two-factor authentication

When 2FA is enabled, sign-in requires two steps:
  1. Enter your email and password
  2. Enter the 6-digit code from your authenticator app (or a one-time backup code)
You’re prompted on every new session — existing sessions stay valid until they expire normally.

​
Disable two-factor authentication

  1. Navigate to Settings > User > Security
  2. In the Two-factor authentication card, click Disable 2FA
  3. Enter your current password to confirm
Disabling clears your TOTP secret and all unused backup codes.

​
Limitations

  • Self-serve only. 2FA is per-user; ShingleAI does not yet support organization-wide 2FA enforcement
  • Active sessions list not yet available. You can’t currently view or revoke individual signed-in sessions from the security settings page — clearing browser cookies or changing your password ends all sessions

​
Recovering a locked-out account

If you’ve lost access to both your authenticator app and your backup codes, contact support — there is no self-serve path to disable 2FA without one of those factors.

​
Next steps

Passkeys

Sign in with biometrics or a hardware key

API keys

Programmatic access for integrations