# Two-factor authentication and account security

> Use an authenticator app, require two-factor authentication in your organisation, sign out devices and reset your password for your Sequential account.

> **In short**
>
> - Two-factor authentication (2FA) asks for a 6-digit code from an authenticator app after your password.
> - Owners and admins can require 2FA for every member of the organisation.
> - Signing in with **Continue with Google** asks for the code too, the same as signing in with a password. A trusted device skips it.
> - If you lose your authenticator app and your backup codes, there is no self-service way to recover your account. Write to support@usesequential.com.
> - Turning off 2FA or regenerating backup codes can ask for a current code from your app or a backup code.
> - Sign out old devices in **Settings** → **Security** → **Sessions**.

## What it is for

Every member of your organisation can open replays and analytics about your customers. 2FA stops a sign-in with a leaked password. The organisation requirement makes sure that every member has 2FA.

## Set up two-factor authentication

Each person turns on 2FA for their own account. You need an authenticator app on a device that you keep with you, such as 1Password, Google Authenticator or Authy.

1. Open **Settings** → **Security**.
2. Click **Set up two-factor authentication**.
3. At **Confirm your password**, enter your **Current password**. Click **Continue**.
4. At **Scan the QR code**, scan the code with your authenticator app. Click **Continue**.
5. At **Enter the code from your app**, type the current code into **Code**. Click **Verify**. Two-factor authentication is now on.
6. At **Save your backup codes**, click **Copy codes** or **Download .txt**. Keep the ten codes somewhere safe, such as a password manager.
7. Click **Done**.

Sequential shows the backup codes only once. Each code works one time.

## Sign in with a code

After a correct password, Sequential shows **Two-factor authentication**.

1. Type the 6-digit code from your authenticator app.
2. Click **Verify**.

You have 10 minutes to enter the code. After that, click **Back to sign in** and enter your password again.

If you do not have your phone, click **Use a backup code** and enter one of your saved codes. To skip the code on this device on later sign-ins, turn on **Trust this device for 30 days**. Do not do this on a shared or public device.

## Require two-factor authentication for your organisation

Owners and admins can require 2FA from every member of the organisation.

1. Set up 2FA on your own account, and sign in with your code. Until you do, the switch is disabled and says "Turn on two-factor authentication for your own account first, in Security."
2. Open **Settings** → **Organisation**. The switch is at the foot of the **Members** card.
3. Switch **Require two-factor authentication** to **On**. From 13 October 2026, Sequential first checks who this affects ("Checking who this affects…"). It does not turn on the requirement yet.
4. Read the check. Each line shows only when it applies:
   - "N members have no two-factor yet: …. Until they set it up, they cannot use this organisation. Sequential sends them to Settings → Security."
   - "N members will sign in again with their code: …."
   - "N agent connections stop: the AI tools that … connected. They must connect them again with two-factor on."
   - "Access tokens keep working."

   The check shows up to 10 names, then "and N more". If nobody is affected, it says "Everyone in this organisation already uses two-factor authentication."
5. Click **Require two-factor**, or click **Cancel**. While the check loads, or if it failed ("Sequential could not check who this affects. Try again."), **Require two-factor** is disabled.

After this, a member without 2FA cannot use anything in the organisation: no analytics, replays, AI or settings. Sequential sends them from every page to **Settings** → **Security**.

A sign-in from before Sequential checked each sign-in has no record of a code. Sequential signs that member out once. The sign-in page then says "Sign in again with your authenticator code: this organisation requires two-factor, and your last session had not passed it."

### Send a reminder

When the check lists members with no two-factor, **Send them a reminder** sends each of them an email. The subject is "<organisation> asks you to turn on two-factor authentication". The email names the organisation and links to **Settings** → **Security**. It names no person.

- A member gets at most one reminder from an organisation in 24 hours. The confirmation says, for example, "Reminder sent to 2 members.", or "Everyone without two-factor had a reminder in the last 24 hours."
- An organisation can send reminders at most 3 times an hour. Then it says "Reminders were sent recently. Try again in N hours."
- The [Audit log](/docs/audit-log) shows, for example, "sent a two-factor reminder to 2 members". It records only the number.

## See and sign out your devices

**Settings** → **Security** → **Sessions** lists each device where you are signed in. **Current** marks the device you are using.

- **Revoke** signs out one other device.
- **Sign out other devices** signs out every device except this one. First it asks you to confirm, for example "Sign out 2 other devices? They'll need to sign in again." Click **Sign out** to continue, or **Cancel**.

If you revoke a device that you trusted, its next sign-in still skips the 2FA code. If someone there could know your password, change the password too.

## Change or reset your password

1. Open **Settings** → **Profile** → **Password**.
2. Enter your **Current password**.
3. Enter a **New password** of at least 10 characters. Enter it again in **Confirm new password**.
4. Click **Update password**. Sequential signs out every other device.

If you forgot your password, click **Forgot password?** on the sign-in page. Sequential sends you a link that is valid for one hour. A reset signs out every device where you were signed in.

A password change or reset also ends every claude.ai connection that you made, in every project. If Sequential cannot end them, it does not change your password. Try again. See [Connect claude.ai](/docs/connect-claude-ai).

## When sign-in says "Too many attempts"

Sequential limits how often a network address can try each action. If you go over a limit, Sequential shows "Too many attempts. Wait a minute and try again." The limits count per network address, not per person, so members on one office network share them.

## Limits

- **No recovery without your codes.** If you lose your authenticator app and your backup codes, there is no self-service way to recover your account. A device that is still signed in keeps working. But on it, **Regenerate backup codes** asks for a code from your app or a backup code, unless that sign-in passed one in the last 15 minutes. The code form says "Lost your authenticator and your backup codes? To get back into your account, write to support@usesequential.com." An admin cannot reset another member's 2FA or password.
- **The requirement checks each sign-in.** A member must have 2FA set up, and this sign-in must have passed a code or a trusted device.
- **Google-only accounts have no password.** They cannot set up 2FA or change a password. Set a password with **Forgot password?** first. The reset creates it.
- **Ten wrong 2FA codes in a row lock code entry for 15 minutes.**
- **You cannot list or remove trusted devices.**
- **Authenticator apps only.** Sequential does not send codes by email or text message.
- **You can change only your name and password.** You cannot change your email, delete your account or upload a picture.
- **The audit log does not reliably track your account.** Sign-ins do not appear in an organisation's [Audit log](/docs/audit-log). Other changes to your own account appear there only some of the time.
- **An admin cannot sign out a member's devices.** Only the member can see and sign out their own devices.

### What 2FA needs

- An authenticator app on a device that you keep with you.
- A password on your account. Setting up, regenerating and disabling 2FA all ask for it.
- To regenerate backup codes or disable 2FA: a current code from your app or a backup code, unless this sign-in passed one in the last 15 minutes.
- For the organisation requirement: the Owner or Admin role, 2FA on your own account, and a sign-in with your code. See [Roles and permissions](/docs/roles-and-permissions).

### More about set-up and sign-in

- You can also open **Security** from the account menu → **Security**. Before set-up, the **Two-factor authentication** card shows **Off**.
- If you cannot scan the QR code, click **Copy key** and type the key in the app.
- After **Use a backup code**, **Use your authenticator app** switches back.
- When the 10 minutes are over, the page says "Your sign-in expired. Go back and sign in again."
- If you sign a trusted device out later, the trust stays.

### Backup codes, turning 2FA off and refused codes

When 2FA is on, the card shows two more actions. Both ask for your current password.

- **Regenerate backup codes** gives you a new set. The old codes stop working.
- **Disable** turns off 2FA. Sign-in then asks for your password only, and your backup codes stop working.

Both actions also ask for a code if this sign-in has not passed a code from your app or a backup code in the last 15 minutes. A sign-in on a trusted device has not passed one.

1. At **Enter a code from your app**, type the current 6-digit code from your app, or one of your backup codes, into **Code or backup code**.
2. Click **Verify and disable** or **Verify and regenerate**.

You can try 5 codes in 15 minutes. After 20 wrong codes in one day (UTC), the card says "Too many failed attempts today. Try again tomorrow, or write to support@usesequential.com."

Sequential can refuse a code with "That code is not valid. Check the time on your device and try again." If this happens, make sure that your phone sets its clock automatically. Codes change every 30 seconds, so a wrong phone clock makes codes that do not match.

### How trusted devices work

Each sign-in on a trusted device renews the 30 days. Sequential cannot list or remove trusted devices. A trusted device stops being trusted 30 days after its last use.

### More about the requirement

- When you switch it on, the confirmation says "Two-factor authentication is now required for every member".
- A member without 2FA sees the notice **Two-factor authentication required** on **Settings** → **Security**. When they have set up 2FA and saved their backup codes, **Continue** takes them into the product.
- The requirement applies to this organisation only. Other organisations keep their own setting.
- A claude.ai connection needs the same rule. A connection that its person made while they had no 2FA stops when the requirement is on. If a person turns off 2FA while the requirement is on, their connections stop too. See [Connect claude.ai](/docs/connect-claude-ai).
- The same switch turns the requirement off, at once and with no check. The confirmation says "Two-factor authentication is no longer required".
- Owners and admins see each member's **Two-factor** (**On** or **Off**) in the **Members** card. See [Roles and permissions](/docs/roles-and-permissions).
- Members and viewers see only whether the requirement is **On** or **Off**.
- If you disable your own 2FA while the requirement is on, Sequential also sends you to **Security**. You must set up 2FA again before you can reach the switch.
- Members who sign in only with Google must set a password before they can set up 2FA. See Limits, above.
- If a Google-only member tries to set up 2FA, the password step says "That password is not right. Try again."
- Sequential records each change to the requirement in the [Audit log](/docs/audit-log).
- Sequential support can also turn the requirement on or off. The audit log then shows "Sequential support made two-factor authentication required for every member" or "Sequential support stopped requiring two-factor authentication". See [Changes by Sequential support](/docs/audit-log#changes-by-sequential-support).

### The device list

- Each row shows the **Device**, the **IP address** and the time it **Signed in**.
- This list shows where you are signed in to Sequential. It does not show the sessions of your own users. For those, see [Sessions](/docs/sessions).
- The **Revoke** button is disabled on the current row. To sign out of this device, use **Sign out** in the account menu.
- If you revoke a device, **Trust this device for 30 days** stays in effect there. If you turned it on, that device's next sign-in skips the 2FA code.
- To change the password, use **Settings** → **Profile** → **Password**.

### How long a sign-in lasts

- A sign-in lasts 30 days. Sequential extends it while you continue to use Sequential.
- If you revoke a device that you trusted, it still skips the code. The trust lasts up to 30 days after you turned it on, or after its last sign-in.
- You see only your own devices. An admin cannot see or sign out another member's devices.
- If you remove someone from the organisation, their access to it ends. See [Roles and permissions](/docs/roles-and-permissions).
- If Sequential's server does not answer when you open a page, Sequential does not sign you out. Sequential treats the server as unreachable when it gives a server error, cannot be reached, or does not answer within 4 seconds. In place of the page, Sequential shows "Sequential can't be reached right now" and "Your session is fine: nothing was signed out, and this page will load as soon as the connection is back." Click **Try again** to load the same page again. The page also says "If it keeps happening, write to support@usesequential.com." Pages that do not need a sign-in, such as these docs, show as if you were signed out.

### Reset steps and the reset message

1. On the sign-in page, click **Forgot password?**.
2. Enter your email.
3. Click **Send reset link**.
4. Open the email "Reset your Sequential password". The link is valid for one hour. If it has expired, click **Request a new link**.
5. Under **Choose a new password**, enter the new password two times. Click **Update password**.
6. Sign in with the new password. If 2FA is on, also enter your code.

From 11 October 2026, a completed reset also verifies your email address, if it was not verified yet. The reset link goes only to your account's own address and works once, so a completed reset proves that you read that email. Sign-in then does not ask you to verify your address. A reset that fails, or a link that expired or was used, changes nothing.

After **Send reset link**, the page always says "If that address exists, we sent a link to reset your password." This way, the page does not show if an account exists.

The reset link carries a secret in its address. From 11 October 2026, Sequential's own website does not record the page that the link opens. It also does not record a sign-in page that leads back to it. The page sends no referrer, so the next page and other websites do not get the link. Your browser does not keep it in its cache.

### Each limit

The limits are there to slow down guessing.

| Action | Allowed from one address |
|---|---|
| Sign in with email and password | 10 a minute |
| Enter a 2FA code, at sign-in or during set-up | 10 a minute |
| Enter a backup code | 5 a minute |
| Request a password reset | 5 a minute |
| **Continue with Google**, change your password, start 2FA set-up, disable 2FA, regenerate backup codes | 3 every 10 seconds |

Two more limits apply to 2FA codes, per account:

- After five wrong codes in one sign-in, the next try ends the sign-in with "Too many attempts. Please request a new code." Start again with your password.
- Ten wrong codes in a row on your account, across sign-ins, lock code entry for 15 minutes. The message says "Too many attempts. Wait a few minutes and try again." A correct code resets the count.

### Profile and appearance

**Settings** → **Profile** shows your **Name** and your **Email**. You can edit the name and click **Save**. If you try to leave the page before you save, a bar asks "You have unsaved changes in Profile. Leave without saving?" Click **Stay** or **Leave**. The email has a **Verified** or **Unverified** badge, and you cannot change it.

Under **Appearance**, select **Dark**, **Light** or **System**. **System** follows the appearance setting of your device. Dark is the default. Sequential remembers the choice on this device only, so set it again in another browser.

### Account events in the audit log

Changes to your own account that appear in the [Audit log](/docs/audit-log) only some of the time include a new password, turning 2FA on or off, and signing out devices. Do not use the log to track them.

## Related

- [Roles and permissions](/docs/roles-and-permissions)
- [Audit log](/docs/audit-log)
- [Sign-up and invitations](/docs/sign-up-and-invitations)
- [Organisations, projects and keys](/docs/organisations-and-projects)
- [Troubleshooting](/docs/troubleshooting)