---
url: https://docs.sunlicense.com/guide/two-factor.md
---
# Two-factor sign-in

Two-factor sign-in protects your SunLicense account with a code from an authenticator app on your phone, on top of
your password (or your Google, GitHub, Discord or Microsoft sign-in). Someone who learns your password still can't
sign in without your phone.

It's on your **account**, so it covers every organization you belong to. Any member can turn it on for themselves,
whatever their role.

## Turn it on

1. Open **Settings → Account** and find **Two-factor sign-in**. Choose **Turn on**.
2. In your authenticator app (Google Authenticator, 1Password, Bitwarden, Authy, Microsoft Authenticator, Aegis…),
   add an account and scan the QR code. Can't scan? Type the key shown under it.
3. Enter the 6-digit code the app shows.
4. Save the **10 recovery codes** somewhere safe, like your password manager (**Copy** or **Download**). They're shown
   only this once.

## Signing in

After your password (or provider), SunLicense asks for the current 6-digit code from the app. Each code works once,
and a new one appears every 30 seconds.

* **The CLI:** `sunlicense login` asks for the code after your password. In a script, pass it with `--code`:

  ```bash
  echo "$PASSWORD" | sunlicense login --email you@company.com --password-stdin --code 123456
  ```

  Older CLI versions can't ask for the code: run `sunlicense update`, or sign in with a personal access token
  (`sunlicense login --with-token`).
* **Joining another organization** with your password, and **claiming a guest account** into your account, ask for the
  code too.
* **Connected AI apps** (claude.ai, ChatGPT, [remote MCP](./remote-mcp)) ask you to approve in the dashboard, so you
  sign in there with your code.
* **Personal access tokens and API keys** keep working as they are: they're their own credential. Create and remove
  them under **Settings → Access tokens** and **API keys**.

Five wrong codes end that sign-in attempt (enter your password again). Ten wrong passwords or codes within 15 minutes
lock sign-in to your account for 15 minutes.

## Lost your phone?

Choose **Lost your phone? Use a recovery code** at the code step and enter one of your recovery codes. Each works once.
Then set up the app again on your new phone: turn two-factor sign-in off and on again under **Settings → Account**.

Running low? **New recovery codes** gives you a fresh set of 10; the old ones stop working.

Lost both your phone and your recovery codes? Write to support from the address on your account. We check that the
account is yours before turning two-factor sign-in off, so this takes longer than a recovery code.

## Turn it off

**Settings → Account → Two-factor sign-in → Turn off**, then enter a current code (or a recovery code). Your password
or provider alone signs you in again, and your recovery codes stop working.