Two-factor authentication and account security

• An authenticator app on a device that you keep with you.
• A password on your account. Setting up, regenerating and disabling 2FA all ask for it.
• To regenerate backup codes or disable 2FA: a current code from your app or a backup code, unless this sign-in passed one in the last 15 minutes.
• For the organisation requirement: the Owner or Admin role, 2FA on your own account, and a sign-in with your code. See Roles and permissions.

• You can also open Security from the account menu → Security. Before set-up, the Two-factor authentication card shows Off.
• If you cannot scan the QR code, click Copy key and type the key in the app.
• After Use a backup code, Use your authenticator app switches back.
• When the 10 minutes are over, the page says "Your sign-in expired. Go back and sign in again."
• If you sign a trusted device out later, the trust stays.

When 2FA is on, the card shows two more actions. Both ask for your current password.

• Regenerate backup codes gives you a new set. The old codes stop working.
• Disable turns off 2FA. Sign-in then asks for your password only, and your backup codes stop working.

Both actions also ask for a code if this sign-in has not passed a code from your app or a backup code in the last 15 minutes. A sign-in on a trusted device has not passed one.

1. At Enter a code from your app, type the current 6-digit code from your app, or one of your backup codes, into Code or backup code.
2. Click Verify and disable or Verify and regenerate.

You can try 5 codes in 15 minutes. After 20 wrong codes in one day (UTC), the card says "Too many failed attempts today. Try again tomorrow, or write to support@usesequential.com."

Sequential can refuse a code with "That code is not valid. Check the time on your device and try again." If this happens, make sure that your phone sets its clock automatically. Codes change every 30 seconds, so a wrong phone clock makes codes that do not match.

Each sign-in on a trusted device renews the 30 days. Sequential cannot list or remove trusted devices. A trusted device stops being trusted 30 days after its last use.

• When you switch it on, the confirmation says "Two-factor authentication is now required for every member".
• A member without 2FA sees the notice Two-factor authentication required on Settings → Security. When they have set up 2FA and saved their backup codes, Continue takes them into the product.
• The requirement applies to this organisation only. Other organisations keep their own setting.
• A claude.ai connection needs the same rule. A connection that its person made while they had no 2FA stops when the requirement is on. If a person turns off 2FA while the requirement is on, their connections stop too. See Connect claude.ai.
• The same switch turns the requirement off, at once and with no check. The confirmation says "Two-factor authentication is no longer required".
• Owners and admins see each member's Two-factor (On or Off) in the Members card. See Roles and permissions.
• Members and viewers see only whether the requirement is On or Off.
• If you disable your own 2FA while the requirement is on, Sequential also sends you to Security. You must set up 2FA again before you can reach the switch.
• Members who sign in only with Google must set a password before they can set up 2FA. See Limits, above.
• If a Google-only member tries to set up 2FA, the password step says "That password is not right. Try again."
• Sequential records each change to the requirement in the Audit log.
• Sequential support can also turn the requirement on or off. The audit log then shows "Sequential support made two-factor authentication required for every member" or "Sequential support stopped requiring two-factor authentication". See Changes by Sequential support.

• Each row shows the Device, the IP address and the time it Signed in.
• This list shows where you are signed in to Sequential. It does not show the sessions of your own users. For those, see Sessions.
• The Revoke button is disabled on the current row. To sign out of this device, use Sign out in the account menu.
• If you revoke a device, Trust this device for 30 days stays in effect there. If you turned it on, that device's next sign-in skips the 2FA code.
• To change the password, use Settings → Profile → Password.

• A sign-in lasts 30 days. Sequential extends it while you continue to use Sequential.
• If you revoke a device that you trusted, it still skips the code. The trust lasts up to 30 days after you turned it on, or after its last sign-in.
• You see only your own devices. An admin cannot see or sign out another member's devices.
• If you remove someone from the organisation, their access to it ends. See Roles and permissions.
• If Sequential's server does not answer when you open a page, Sequential does not sign you out. Sequential treats the server as unreachable when it gives a server error, cannot be reached, or does not answer within 4 seconds. In place of the page, Sequential shows "Sequential can't be reached right now" and "Your session is fine: nothing was signed out, and this page will load as soon as the connection is back." Click Try again to load the same page again. The page also says "If it keeps happening, write to support@usesequential.com." Pages that do not need a sign-in, such as these docs, show as if you were signed out.

1. On the sign-in page, click Forgot password?.
2. Enter your email.
3. Click Send reset link.
4. Open the email "Reset your Sequential password". The link is valid for one hour. If it has expired, click Request a new link.
5. Under Choose a new password, enter the new password two times. Click Update password.
6. Sign in with the new password. If 2FA is on, also enter your code.

From 11 October 2026, a completed reset also verifies your email address, if it was not verified yet. The reset link goes only to your account's own address and works once, so a completed reset proves that you read that email. Sign-in then does not ask you to verify your address. A reset that fails, or a link that expired or was used, changes nothing.

After Send reset link, the page always says "If that address exists, we sent a link to reset your password." This way, the page does not show if an account exists.

The reset link carries a secret in its address. From 11 October 2026, Sequential's own website does not record the page that the link opens. It also does not record a sign-in page that leads back to it. The page sends no referrer, so the next page and other websites do not get the link. Your browser does not keep it in its cache.

The limits are there to slow down guessing.

Two more limits apply to 2FA codes, per account:

• After five wrong codes in one sign-in, the next try ends the sign-in with "Too many attempts. Please request a new code." Start again with your password.
• Ten wrong codes in a row on your account, across sign-ins, lock code entry for 15 minutes. The message says "Too many attempts. Wait a few minutes and try again." A correct code resets the count.

Settings → Profile shows your Name and your Email. You can edit the name and click Save. If you try to leave the page before you save, a bar asks "You have unsaved changes in Profile. Leave without saving?" Click Stay or Leave. The email has a Verified or Unverified badge, and you cannot change it.

Under Appearance, select Dark, Light or System. System follows the appearance setting of your device. Dark is the default. Sequential remembers the choice on this device only, so set it again in another browser.

Changes to your own account that appear in the Audit log only some of the time include a new password, turning 2FA on or off, and signing out devices. Do not use the log to track them.