Two-Factor Authentication

  • Account and plans
  • All plans
View as Markdown

What it does

An AgentsRoom account that signs in with an email and a password can ask for a second proof at sign-in: the 6-digit code shown by an authenticator app on your phone (Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden, Apple Passwords and the like). A stolen password is then not enough to open the account, and with it the connections, prompts and settings it carries to your other computers. Turning it on also gives you 10 single-use recovery codes, each one signing you in once if you lose the phone. The code is asked at every password sign-in: the desktop app, the phone, the site's sign-in page and the sign-in of a public feedback portal. Available since 2026-10-02.

Where to find it

  • Desktop: Settings > Account > the Two-factor authentication card, at the top of the tab ("Ask for a code from your phone on top of your password when you sign in.").
  • Desktop, Databases window: a password account without two-factor authentication sees the banner "Protect the account that holds your connections" with a Turn on button that opens the card.
  • Phone: Settings > Account > Two-factor authentication, which shows On or Off and opens its own screen.

How to use it

  1. Open the card and click Turn on.
  2. Type Your AgentsRoom password, then Continue.
  3. Scan the QR code with your authenticator app ("Can't scan? Enter this key in the app:" gives the key to type by hand). On the phone there is no QR code: Open in authenticator app adds AgentsRoom to the authenticator of the same phone, and Copy key copies the key.
  4. Type the 6-digit code the app shows, then Verify and turn on.
  5. Save the recovery codes now (Copy, Download on the desktop, Share on the phone), then I saved them. They are never shown again.

Signing in afterwards: after the password, the window "Two-factor authentication, One more step to sign in" asks for the 6-digit code. "Lost your phone? Enter one of your recovery codes instead." Each recovery code works once.

Managing it: the card then reads "On. You have N unused recovery codes left." New recovery codes replaces the whole set (a current code is required). Turn off asks for your password and a code.

Settings

None. The state lives on your account, on the server, and every computer and the phone read the same state.

Agent tools (MCP)

None. Agents never see or handle your sign-in.

Providers

All providers, no difference. This protects your AgentsRoom account, not the accounts of the agent CLIs (Claude Code, Codex...), which keep their own sign-in.

Mobile

Present, same words as the desktop: the code step at sign-in, turning it on, new recovery codes and turning it off, from Settings > Account > Two-factor authentication. The setup opens the authenticator app of the phone instead of showing a QR code.

Limits

  • Password accounts only. An account that signs in with Continue with Google or Continue with Apple is protected by Google's or Apple's own two-step verification, and the card says so instead of offering the switch.
  • An account that has both a password and a Google or Apple sign-in can still enter through Google or Apple without the AgentsRoom code.
  • No SMS codes, no passkeys, no "trust this device" option. The code is asked only at a real sign-in; the desktop and the phone stay signed in between two sign-ins, so you do not type it every day.
  • Too many wrong codes lock the sign-in for a moment ("Too many attempts. Wait a minute and try again.").
  • An older version of the app cannot complete the code step and asks you to update AgentsRoom.
  • AgentsRoom cannot turn it off for you if you lose both the phone and the recovery codes: keep the codes in a password manager.

Common questions

  • The code is refused. "This code is not valid. Check that your phone's clock is set automatically and try the next code." Codes change every 30 seconds and depend on the phone's clock.
  • I lost my phone. Sign in with one of your recovery codes, then turn two-factor authentication off and on again to pair the new phone (or use New recovery codes if you only lost the codes).
  • Do I have to type the code every time I open the app? No, only when you sign in again (new computer, after signing out).
  • Why does the Databases window ask me to turn it on? Your connections follow your account to your other computers; it is a suggestion, never a requirement, and the window works without it.
  • Is it required for synced passwords? Yes, for a password account: Synced Passwords cannot be turned on until two-factor authentication is on.

Related