Two-factor sign-in

Two-factor sign-in protects your SunLicense account with a code from an authenticator app on your phone, on top of your password (or your Google, GitHub, Discord or Microsoft sign-in). Someone who learns your password still can't sign in without your phone.

It's on your account, so it covers every organization you belong to. Any member can turn it on for themselves, whatever their role.

Turn it on

1. Open Settings → Account and find Two-factor sign-in. Choose Turn on.
2. In your authenticator app (Google Authenticator, 1Password, Bitwarden, Authy, Microsoft Authenticator, Aegis…), add an account and scan the QR code. Can't scan? Type the key shown under it.
3. Enter the 6-digit code the app shows.
4. Save the 10 recovery codes somewhere safe, like your password manager (Copy or Download). They're shown only this once.

Signing in

After your password (or provider), SunLicense asks for the current 6-digit code from the app. Each code works once, and a new one appears every 30 seconds.

• The CLI: sunlicense login asks for the code after your password. In a script, pass it with --code:

  echo "$PASSWORD" | sunlicense login --email [email protected] --password-stdin --code 123456

  Older CLI versions can't ask for the code: run sunlicense update, or sign in with a personal access token (sunlicense login --with-token).

• Joining another organization with your password, and claiming a guest account into your account, ask for the code too.

• Connected AI apps (claude.ai, ChatGPT, remote MCP) ask you to approve in the dashboard, so you sign in there with your code.

• Personal access tokens and API keys keep working as they are: they're their own credential. Create and remove them under Settings → Access tokens and API keys.

Five wrong codes end that sign-in attempt (enter your password again). Ten wrong passwords or codes within 15 minutes lock sign-in to your account for 15 minutes.

Lost your phone?

Choose Lost your phone? Use a recovery code at the code step and enter one of your recovery codes. Each works once. Then set up the app again on your new phone: turn two-factor sign-in off and on again under Settings → Account.

Running low? New recovery codes gives you a fresh set of 10; the old ones stop working.

Lost both your phone and your recovery codes? Write to support from the address on your account. We check that the account is yours before turning two-factor sign-in off, so this takes longer than a recovery code.

Turn it off

Settings → Account → Two-factor sign-in → Turn off, then enter a current code (or a recovery code). Your password or provider alone signs you in again, and your recovery codes stop working.