Security
Protect password sign-in with a code from an authenticator app, and keep backup codes for when you lose your phone.
Two-step verification adds a second check to password sign-in: after your password, Pozy asks for a 6-digit code from an authenticator app on your phone. Someone who learns your password still cannot get in.
It works with any TOTP app: Google Authenticator, Microsoft Authenticator, 1Password, Authy, Apple Passwords and others. It applies to password sign-in. If you sign in with Google or through your company's single sign-on, the second factor is handled there.
#Turn it on
You need a password on your account. If you only ever signed in with Google, set one on the Profile tab of Settings first.
#Confirm your password
Open Settings → Security and turn on two-step verification. Pozy asks for your password. It asks again whenever you turn the feature on or off.
#Scan the QR code
Open your authenticator app, add an account and scan the code. If you cannot scan, type the setup key shown under it. The app lists the account as Pozy.
#Enter the code
Type the 6-digit code the app shows. Codes change every 30 seconds; if one fails, wait for the next.
#Save your backup codes
Pozy shows 10 backup codes once. Each one signs you in a single time if you lose your phone. Store them in a password manager or print them, then confirm you saved them.
#Signing in
After your email and password, Pozy asks for the code from your app. You can choose Use a backup code instead if your phone is not with you. Tick Trust this device for 30 days to skip the code on that device for the next 30 days.
If the sign-in expires before you enter a code, start again with your email and password.
#Lost your phone
- Sign in with one of your backup codes.
- In Settings → Security, turn two-step verification off and on again with your new phone, or generate new codes.
Generate new backup codes replaces all 10 codes at once. The old ones stop working immediately, so save the new set before you close the dialog.
Lost both your phone and your backup codes? Email support@pozy.ai from the address on the account.
#For workspace owners
Two-step verification is set per person. Ask everyone who signs in with a password to turn it on, or move the team to single sign-on so your identity provider enforces MFA.
| Situation | What protects the account |
|---|---|
| Password sign-in | Password plus two-step verification, if the person turned it on. |
| Google sign-in | Google's own security, including Google's 2-step verification. |
| Single sign-on | Your identity provider's MFA and policies. |
| API keys and MCP tokens | Not affected by two-step verification. Scope and revoke them separately. See Security. |
#Related
- Security: sessions, devices and the activity log.
- Single sign-on: move MFA to your identity provider.