# Two-factor authentication

> Two-factor authentication (2FA) adds a second step to signing in, so your account is safe even if your password is stolen.

Source: https://infranest.io/docs/two-factor-authentication
Last updated: 2026-09-14

---

Two-factor authentication (2FA) adds a second step to signing in, so your account stays safe even if your password is stolen. This article is for anyone setting up or managing 2FA on their InfraNest account.

## Overview

- 2FA protects your account by requiring a second proof of identity beyond your password.
- You can use **passkeys** (fingerprint, face, phone or a hardware security key) or an **authenticator app** (a 6-digit code that changes every 30 seconds) — either one satisfies the requirement.
- Passkeys are the safer option because they only work on the real InfraNest site, so they can't be tricked out of you by a fake sign-in page.

## Choose a method

- Pick **passkeys** if your device supports fingerprint, face unlock, or you have a hardware security key. Nothing to type or copy.
- Pick an **authenticator app** if you'd rather not use passkeys, or your device doesn't support them. Comes with recovery codes as a backup.

## Set up passkeys

1. Go to **Profile → Security → Passkeys** and choose **Add a passkey**.
2. Confirm with your fingerprint, face, device PIN or security key when your browser asks.
3. Choose **Add a second passkey**, ideally on a different device or a hardware key.

<!-- docs-screenshots:start -->

![Two-factor authentication](/media/3689e6c8-1291-4cd4-8a16-7dbed27cbd85)

<!-- docs-screenshots:end -->

You need two passkeys, not one — a single passkey has no backup, so losing that device would lock you out. That's also why one passkey alone doesn't satisfy a 2FA requirement: you need two passkeys, or one passkey plus an authenticator app.

### Synced, or this device only?

Each passkey in your list shows which type it is.

- **Synced** — copied to your other devices through iCloud Keychain, a password manager, or your Google account. Convenient, and losing one device doesn't lose the passkey.
- **This device only** — tied to the device or security key it was created on. Safer, since there's no copy anywhere else — but if you lose that device, the passkey is gone too.

> [!NOTE]
> Two **synced** passkeys from the same account aren't a real backup — they live in the same place, so whatever causes you to lose one is likely to cost you both. Pairing a synced passkey with a **this device only** hardware key is the stronger combination.

A passkey added before InfraNest started tracking this type won't show either label. That's not an error — we simply don't know, and we'd rather show nothing than guess.

## Set up an authenticator app

1. Go to **Profile → Security** and start two-factor authentication setup.
2. Scan the **QR code** with an authenticator app (like Google Authenticator or 1Password).


3. Enter a code from the app to confirm, then save your recovery codes somewhere safe.

From then on, you'll enter a code from your app each time you sign in.

> [!WARNING]
> Keep your recovery codes safe — they're the only way back in if you lose your authenticator, and they're shown only once.

## Recover access after losing a device

1. If you use an authenticator app, enter one of your recovery codes in place of the app code when signing in.
2. If you use passkeys, sign in with your other passkey.
3. Add a replacement passkey for the one you lost.
4. If you're locked out completely, contact an organisation admin for help.

## Troubleshooting

- **2FA is required and I can't remove my only method.** Once a 2FA requirement applies to you, InfraNest won't let you remove the last method that satisfies it. If passkeys are all you have, removing one is blocked until you've set up an authenticator app or added another passkey. This prevents you from accidentally locking yourself out.
- **My organisation requires 2FA.** You'll be prompted to set it up before continuing, and you can choose either passkeys or an authenticator app on that screen.