Two-factor
Two-factor means signing in, and making changes that matter, takes something you have as well as something you know. TypeFuse offers two ways, and you can use both:
- Passkeys. Your device confirms it's you with your fingerprint, face or PIN. You can add several (a laptop, a phone, a security key), name them, and see when each was last used. A passkey also signs you in on its own, with no password.
- An authenticator app. An app such as 1Password, Google Authenticator or Authy shows a new six-digit code every 30 seconds. You can have one per account.
TypeFuse doesn't send codes by email or text message: both can be intercepted.
Setting it up
Open Account from the menu under your name. Under Two-factor, choose Add a passkey and follow your browser, or Set up an authenticator app, scan the QR code and type the code it shows.
When you add your first passkey or app, TypeFuse shows ten recovery codes. Each signs you in once if you lose your devices. They're shown only this once: keep them in your password manager or somewhere safe. You can make a new set at any time, which stops the old ones working.
After you sign up, TypeFuse offers to add a passkey straight away. You can skip it and come back to Account later.
Signing in
With two-factor on, signing in with your password or with Google asks for your passkey, a code from your app or a recovery code next. On the log-in page, Continue with a passkey signs you in with the passkey alone.
Once you have a passkey and your recovery codes, you can remove your password from Account and sign in with the passkey only. Forgot your password? on the log-in page sets one again if you need it.
Repeated wrong codes lock the second step for a minute, then longer each time.
Confirming it's you
Some changes ask you to confirm it's you again, with your passkey or a code, even though you're signed in. Once you have, you're not asked again for ten minutes.
Your own account always asks before you delete it, change its two-factor or password, make a personal access token or connect an app. An organisation's owners choose which of its actions ask, in Settings → Members → Security:
- Billing and plan changes (on unless an owner turns it off).
- Creating API keys, deploy tokens and access tokens (on).
- Changing security settings and member roles, inviting people, and who approves deployments (on).
- Deleting the organisation (on).
- Deploying to Production, approving deployments and taking a Decision out of Production (off).
If you don't have two-factor, these actions aren't blocked; the app suggests adding a passkey instead. Personal access tokens, connected apps and deploy tokens aren't asked: they were confirmed when they were made.
Requiring two-factor in an organisation
An owner can turn on Require two-factor for members in Settings → Security. It's off by default, and an owner needs two-factor themselves before turning it on. The Security section shows how many members have it, and the Members list shows who.
When it's turned on, every member without two-factor gets an email and a notification, and the next time they open the organisation they're asked to add a passkey or an authenticator app before going on. Their other organisations aren't affected. New keys, tokens and connected apps for the organisation need two-factor, and personal access tokens and connected apps made without two-factor stop working there: before it's turned on, the owner sees which ones and whose they are, and the people who hold them are told how to replace them (make a new token, or sign in from the app again, once they have two-factor). API keys → Personal tokens marks each one "Made without two-factor". Runtime API keys and deploy tokens belong to the organisation and keep working. Signing in with Google counts only once a passkey or an authenticator app is added. Owners can't set up or reset a member's two-factor for them; they can see who hasn't set it up and remove someone from the organisation.
If you lose your devices
- Use another factor. Another passkey or your authenticator app still works.
- Use a recovery code. On the second step of signing in, type one of your recovery codes. Then remove the lost passkey or app in Account and add a new one.
- Recover by email. If you've lost every passkey, your app and your recovery codes, sign in with your password (or Google) and choose Lost your passkey, app and recovery codes? We email your account straight away, and a reminder a day before the 72-hour wait is over. Each has a This wasn't me link that cancels it, and anyone still signed in to your account can cancel it from Account too. If an organisation you belong to requires two-factor, its owners are told.
- Finish from the email. When the wait is over we email a Finish recovery link. Nothing changes until you open it and confirm. Then two-factor is removed, you're signed out everywhere, and your personal access tokens and connected apps stop working. Log in and you're asked to add a new passkey or app straight away. The link works once, for seven days; after that the recovery lapses and you can start again.
If you sign in with a passkey, your app or a recovery code before the recovery is finished, it's cancelled, and so is its link.
Your passkeys and app belong to you across every organisation you're in, so an organisation's owners and admins can't reset them. If none of the steps above works, contact TypeFuse support: once they've checked it's you, they can reset your two-factor. You're signed out everywhere, your personal access tokens and connected apps stop working, and you add a new passkey or app when you next sign in; the reset is recorded in your account's security activity and you're emailed.
Staying informed
Every change to your two-factor (a passkey added or removed, the app set up or removed, new recovery codes, a recovery code used, a reset or a recovery) is emailed to you and appears in your notifications, with Recent security activity on the Account page.