# Two-factor sign-in and passkeys > Turn on two-factor sign-in with an authenticator app, keep your recovery codes and add passkeys – and how organization owners require two-factor sign-in and reset it for someone who lost their phone. Source: https://contals.com/docs/en/settings/two-factor/ Last updated: 2026-10-16 Two-factor sign-in protects your account with a second proof: after your password, a sign-in link or Google, Microsoft and other providers, Contals also asks for a code from an authenticator app on your phone. A passkey – your fingerprint, your face or the PIN of your device – counts as both factors. You set up both on your profile; organization owners can require two-factor sign-in. ## 1. Set up two-factor sign-in Open your profile (avatar → **Profile and settings**), go to **Two-factor sign-in** and choose **Set up**. If your account has a password, confirm it first. Scan the QR code with an authenticator app – for example Google Authenticator, Microsoft Authenticator, Aegis or a password manager; if you cannot scan it, type the key shown below the code into the app. Enter the 6-digit code the app shows and choose **Turn on**. Turning it on signs out your other devices: sign in there again with a code. You get an e-mail about the change. ## 2. Keep your recovery codes Right after you turn it on, Contals shows ten **Recovery codes**. Each one signs you in once if you lose your phone. They are shown only this one time: **Copy** or **Download** them, keep them in a password manager or printed, and choose **I saved them**. ## 3. Sign in with a code Sign in as usual. Then the page **Two-factor sign-in** asks for the **Code from the app**; enter it and choose **Continue**. Instead, you can **Use a recovery code** or, if you added one, **Use a passkey instead**. If the code is refused, check the time on your phone and try the next code. After too many wrong codes, Contals asks you to sign in again or locks two-factor sign-in for 15 minutes. A sign-in link only proves the first factor: its page leads to the code step too. Signing in through your organization's own single sign-on needs no code from Contals – your organization's identity provider is responsible for the second factor there. ## Passkeys A passkey signs you in without a password and without a code. - **Add one:** profile → **Passkeys** → enter a **Name of the passkey** (for example "Phone" or "Laptop") → **Add a passkey**, then confirm with your fingerprint, face or device PIN. Synced passkeys are marked **Synced**; you can keep up to ten. - **Sign in:** on the sign-in page, choose **Sign in with a passkey**. A passkey also answers the code step after another way of signing in. - **Rename** or **Remove** a passkey in the list. Adding and removing one is e-mailed to you. If your organization requires single sign-on for your address, you cannot add passkeys – only the organization's owners keep them, as an emergency way in. ## New recovery codes or turning it off - **New recovery codes:** enter a code from the app (and your password, if your account has one) and choose **Confirm**. The old recovery codes stop working at once. - **Turn off:** enter a code from the app or a recovery code (and your password, if any) and choose **Confirm**. You get an e-mail about it. If your organization requires two-factor sign-in, you cannot work in it again until you set it up anew. Setting it up, new recovery codes, turning it off and adding or removing a passkey need a sign-in within the last 24 hours. Otherwise the page asks you to **Sign in again** first. ## When your organization requires it When an owner switches on **Require two-factor sign-in**, everyone who works in the organization – members, volunteers, viewers, admins and board guests – sees only the page **Set up two-factor sign-in** until they have done it; it takes a minute with an authenticator app. Contals checks the requirement on the server, also for card links and API tokens. People who sign in through the organization's required single sign-on are covered by its identity provider. A passkey meets the requirement too: whoever has one counts as "with two-factor sign-in", and then a password, a sign-in link or a provider asks for the passkey as the second step. An owner with only a passkey can switch the requirement on. ## Lost your phone? - **You still have your recovery codes:** sign in with **Use a recovery code**. Then turn two-factor sign-in off with another recovery code and set it up again on your new phone. - **You lost the recovery codes too:** ask an owner of your organization. An owner can reset your two-factor sign-in if you work in no other organization; otherwise Contals support does it. After a reset, your authenticator app, your recovery codes and your passkeys stop working, you are signed out everywhere and you get an e-mail. Sign in again and set it up anew. ## For organization owners Organization settings → **Two-factor sign-in** shows how many people have it on, how many board guests do not, and everyone **With two-factor sign-in** and **Without two-factor sign-in**. Admins see the section; only owners change it. - **Require two-factor sign-in** can be switched on once you have turned two-factor sign-in on for yourself. - **Reset** next to a person turns off their two-factor sign-in and removes their passkeys – for someone who lost their phone and their recovery codes. It is offered for people who have two-factor sign-in on and work in no other organization, and it needs a sign-in within the last 24 hours. First check that it is really them asking, for example by calling them. The reset is recorded in the [audit log](/docs/en/settings/audit-log/), and the person gets an e-mail. See also [sign-in methods and single sign-on](/docs/en/settings/sign-in/).