Two-factor authentication
With two-factor authentication on, signing in to the app takes two things: what you sign in with today (your password, a magic link, or your Google or GitHub account) and a 6-digit code from an authenticator app on your phone. Someone who learns your password still cannot get in.
It is optional, every member decides for their own account, and it is included in every plan.
Turn it on
- In the app, open the menu at the bottom of the sidebar (your name) and choose Two-factor authentication.
- Choose Set up two-factor authentication, name the authenticator, for example "iPhone" or "1Password", and choose Continue. The name tells your devices apart later and cannot be changed afterwards.
- Scan the QR code with an authenticator app: 1Password, Google Authenticator, Microsoft Authenticator, Authy and every other app that speaks TOTP work. Without a camera, type the setup key shown beside the code into the app.
- Enter the 6-digit code the app shows and choose Turn on two-factor authentication.
From then on every sign-in asks for a code after the first step. Turning it on signs out your other sessions, so every browser proves itself once. Codes change every 30 seconds; if one is refused although you typed it right, set the clock of your phone to automatic.
There are no recovery codes. Add a second authenticator as a backup on the same page with Add another authenticator, such as a password manager next to the phone, and either one signs you in. With several, the code prompt lets you pick which one you are reading from.
What it covers
| With two-factor authentication on | |
|---|---|
| Signing in to the app (password, magic link, Google, GitHub) | asks for a code |
| Resetting a forgotten password | the link from the email asks for a code before the new password can be set |
formfeed login | you approve the command line in the app, so behind the code |
| AI agents on the hosted MCP endpoint | you allow each agent on its consent page, behind the code |
| API keys | unchanged: a key is a credential of its own and never asks for a code |
API keys keep working because servers cannot type codes. Treat them accordingly: a key in the wrong hands is not stopped by your authenticator, so revoke keys you no longer need.
Agents that were connected before
An agent acts for an account with two-factor authentication only after that account allowed it from a session that passed the code. An agent you allowed before you turned two-factor authentication on is therefore refused from its next token on, which it gets within the hour: connect it again and allow it once more on the consent page. Until then, and for any agent that was never allowed this way, the API answers 403 forbidden with the reason. Connected agents in the same menu lists the agents your account allowed and revokes one.
Turn it off
On the same page, remove your authenticators with the bin icon (Remove authenticator) and confirm with Remove. Removing the last one switches two-factor authentication off, and signing in takes no code any more.
Lost your phone?
Use your second authenticator, if you added one, and replace the lost one on the page above.
Without one, write to support@formfeed.dev from the address of the account; a request from any other address gets only the answer to write from that one. We switch two-factor authentication off once we have checked that the account is yours, which takes longer than reading a code: expect questions only the account's owner can answer, and an owner of your organisation may vouch for you from their own address. Your API keys keep working in the meantime, so nothing that renders is interrupted.
Afterwards you sign in with your password, magic link or Google or GitHub account alone. Turn two-factor authentication on again, this time with a second authenticator.