---
title: "Two-factor authentication and sessions"
description: "Protect your sign-in with an authenticator app, require two-factor authentication for a team, and sign out devices or limit session length."
url: "https://cookiebeam.com/docs/account/security"
lang: "en"
---

# Two-factor authentication and sessions

Protect your sign-in with an authenticator app, require two-factor authentication for a team, and sign out devices or limit session length.

## Turn on two-factor authentication

CookieBeam supports two-factor authentication (2FA) with an authenticator app that shows 6-digit codes.

1. Open **Account settings** and select the **Security** tab.
2. Under **Two-factor authentication**, select **Set up two-factor authentication** and enter your current password. If you sign in with Google and have no password, you may be asked to sign in again first.
3. Scan the QR code with your authenticator app. If you cannot scan it, enter the key shown below the code.
4. Enter the 6-digit code from the app and select **Verify and enable**.
5. Save the recovery codes. Download them or store them in a password manager, then select **I have saved these codes**.

Each recovery code works once, in place of an app code, if you lose your phone. The **Security** tab shows how many are left. Select **Regenerate recovery codes** to replace them all.

To turn 2FA off, select **Disable two-factor authentication** and confirm with your password and an app or recovery code. If one of your teams requires 2FA, you will be asked to set it up again.

## Require two-factor authentication for the team

Owners and admins can make 2FA mandatory for everyone on the team.

1. Open **Team**.
2. Under **Require two-factor authentication**, turn on **Require 2FA for all members**.

The card shows how many members have 2FA enabled. Members without it are taken to the **Security** tab on their next visit and cannot use the dashboard until they set it up. The requirement can take up to 15 minutes to reach someone who is already signed in.

Members who sign in through your team's [single sign-on](https://cookiebeam.com/docs/account/sso-and-scim) are not asked for CookieBeam 2FA. Your identity provider handles the second factor for them.

## Change your password or email address

Both are on **Account settings**:

- **Change Password** is on the **Security** tab. Enter your current password and the new one twice.
- To change your email address, edit it on the **Business Profile** tab and confirm with your current password. CookieBeam sends a verification link to the new address, and the change takes effect when you open it. You can cancel a pending change.

## Active sessions

Go to `/dashboard/settings/sessions` in the dashboard to see where you are signed in. The page is not in the sidebar.

- **Active sessions** lists your devices with when they signed in, their last activity and when they expire.
- **Sign out this device** ends one session. **Sign out every device** ends all of them, including devices that signed in before session tracking was introduced and are not listed.

## Team session policy

The team owner can limit how long a session stays valid for this team. On the same sessions page:

1. Under **Team session policy**, set **Maximum lifetime (minutes)**.
2. Optionally set **Idle timeout (minutes)**. Leave it blank to turn the idle timeout off.
3. Select **Save session policy**.

**Team sessions** lists members' sessions in this team. Select **Revoke team access** to sign a member's session out of the team.

If your access to a team has expired or been revoked, the same page lets you sign in again or switch to another team.

## Related

- [Single sign-on and SCIM](https://cookiebeam.com/docs/account/sso-and-scim)
- [Team members and roles](https://cookiebeam.com/docs/account/team-and-roles)