Docs
Require two step sign in
Make two step sign in a rule for everyone in your workspace. Members without an authenticator code or a passkey are asked to set one up before they can open the workspace. Team.
1. Set up two step sign in on your own account
Settings, Security. Add an authenticator app or a passkey. Only an Owner or Admin who has two step sign in can turn the rule on.
2. Turn on the rule
Dashboard, Team, "Members must use two step sign in", then Require two step sign in. The card shows since when it is required and how many members have not set it up yet.
3. Members set it up
A member without an authenticator code or a passkey cannot open the workspace: switching to it is refused, and a banner and Settings send them to set it up. Once they add one, the workspace opens as before.
CLI and MCP
appforshare whoami and the MCP tool whoami show when the workspace requires two step sign in. Both are read only: the rule is set in the dashboard only.
$ npx appforshare whoami
[email protected] in Acme (owner), plan team
Two step sign in: required for members of this workspace (set in the dashboard, Team)Questions
- Which plan includes the rule?
- Team. It applies to every member of the workspace.
- What counts as two step sign in?
- An authenticator code or a passkey. Either one is enough.
- Can I see who has it?
- Yes. The member list on the Team page shows the Owner and Admins who has two step sign in and who does not.
- A member lost their phone. What now?
- The Owner can reset the member's authenticator with Reset two step on the Team page, confirmed with the Owner's own current code or a recovery code. The member is signed out everywhere and gets an email; their passkeys stay. They then set up a new authenticator.
- Do API tokens and connected AI apps stop working?
- No. API tokens and connected MCP apps keep working, because they are not sign ins.
- Can the Owner turn off their own two step sign in?
- Not while the rule is on. The Owner keeps two step sign in for as long as the workspace requires it.
- Is there a record of changes?
- Yes. Turning the rule on or off and every reset is a security line in the activity feed.
Overview: require two step sign in. Related: single sign on, plans.