Does a passkey count?

Yes. An authenticator app code or a passkey both count as the second step.

Will my CI stop working?

No. API tokens and connected MCP apps keep working, because they are not sign ins.

Can two step sign in be used on other plans?

Yes. Every account can turn it on for itself. Requiring it for every member of a workspace is on Team.

Every member signs in with a second step

Team

A workspace holds signing certificates, store keys and builds that are not public yet. One member with a reused password is enough to put all of that at risk.

On Team, the Owner or an Admin turns on "Members must use two step sign in". Anyone without an authenticator code or a passkey is sent to set one up and cannot open the workspace until they have.

Start free See plans

Example

Team members

Two step sign inRequired for every member
Sara (Admin)Authenticator app
Lee (Developer)Passkey
Ana (Viewer)Not set up, cannot open the workspace yet

Example values.

Made for

Teams whose security review asks whether two step sign in is enforced
Agencies that add client staff and freelancers to a workspace
Owners who want to see who is protected at a glance

What it ends

Asking each member to turn it on and hoping they did
No list of who has a second step
A lost phone meaning a support ticket

How it works

Step 1
Turn on the rule
On the Team page, the Owner or an Admin who uses two step sign in turns on "Members must use two step sign in".
Step 2
Members set it up
A member without it sees a banner and is sent to Settings to add an authenticator app or a passkey. Until then, switching into the workspace is refused.
Step 3
See who has it
The member list shows, for the Owner and Admins, who signs in with a second step.

Lost authenticator

The Owner can reset a member's authenticator with the Owner's own current code. The member is signed out everywhere and gets an email; their passkeys stay. The Owner keeps two step sign in on while the rule is on.

What keeps working

API tokens and connected MCP apps are not sign ins, so CI uploads and AI assistants keep working. Each change to the rule is a security line in the activity feed. appforshare whoami and the MCP tool whoami show whether the rule is on; it can only be changed in the dashboard.

Good to know

The rule covers members of the workspace. Testers install from links and never sign in.
It is set in the dashboard only; there is no CLI or MCP setter, by design.

Questions

Does a passkey count?: Yes. An authenticator app code or a passkey both count as the second step.
Will my CI stop working?: No. API tokens and connected MCP apps keep working, because they are not sign ins.
Can two step sign in be used on other plans?: Yes. Every account can turn it on for itself. Requiring it for every member of a workspace is on Team.