Help centerAccount and preferences
FIELD GUIDE 14 / 15
Protect account access with email two-factor authentication
Set up the optional second email check, understand code limits and recover safely from sign-in problems.
Product guide 3 sections
Enable or disable the second check
- 01Prerequisites: sign in using your existing method and keep access to the email shown in Settings → Email two-factor authentication.
- 02Choose Set up email verification. In the same browser, enter the six-digit code from your inbox and choose Confirm and enable.
- 03Check that Protection is on. Requesting a code alone does not enable protection. Cancel leaves the existing setting unchanged.
- 04To turn it off, choose Turn off, request a fresh code, then Confirm and turn off. Changing protection signs out other sessions.
Keep in mind
These are implemented controls, not a claim that enrollment is verified on the published app. The security release still requires its approved database/build and end-to-end sign-in checks. A delivered example email is not proof of a complete sign-in flow.
These are implemented controls, not a claim that enrollment is verified on the published app. The security release still requires its approved database/build and end-to-end sign-in checks. A delivered example email is not proof of a complete sign-in flow.
Sign in and handle expired codes
- 01Complete your original password, Google, GitHub or Slack sign-in. When protection is enabled, the web browser is not signed in until you verify the email code.
- 02Use the newest code in the requesting browser. Codes expire after 10 minutes, work once and allow five incorrect submissions.
- 03Wait at least 60 seconds before Resend code. Resend replaces the code but does not extend the challenge lifetime or reset attempts. If the challenge expires, start sign-in again.
- 04If the service limits attempts, stop and wait rather than repeatedly submitting. Check spam and the account inbox; never send your code to another person.
Lost inbox, password reset or unexpected sign-out
A password reset uses a single-use link that expires in one hour; it does not disable two-factor protection. There are no backup codes, trusted-device bypass or automatic lost-inbox override. Use Support for guidance, not as a promise of restored ownership. Recover the email account through its provider when necessary. Email is less phishing-resistant than an authenticator app.
Keep in mind
Security updates can require existing sessions to sign in again. Web two-factor settings do not unlink Slack installations or change native Slack bot actions. A different OAuth provider with the same email must not be used as an account-recovery bypass.
Security updates can require existing sessions to sign in again. Web two-factor settings do not unlink Slack installations or change native Slack bot actions. A different OAuth provider with the same email must not be used as an account-recovery bypass.
More in Account and preferences
Manage company ownership and requestsUse the company console for roles, exports, installation administration, and requests that need review.Manage notificationsChoose in-app alerts, Slack DMs, optional activity email and per-browser desktop notifications separately.Review your profile and change appearanceCheck your account identity and choose a light, dark, or system-matched appearance.