Skip to main content

Two-Factor Authentication

Add an extra layer of security to your CODITECT account with two-factor authentication (2FA).

What is 2FA?​

Two-factor authentication requires two forms of verification:

  1. Something you know - Your password
  2. Something you have - Your phone/authenticator app

Even if someone steals your password, they can't access your account without the second factor.

Setting Up 2FA​

Works with Google Authenticator, Authy, 1Password, or any TOTP app.

  1. Go to Settings → Security → Two-Factor Authentication
  2. Click Enable 2FA
  3. Select Authenticator App
  4. Scan QR code with your app:
┌─────────────────────────────────────┐
│                                     │
│    ██████████████████████████████   │
│    ██                        ██     │
│    ██  ████████████████  ██  ██     │
│    ██  ██              ██  ██  ██   │
│    ██  ██  ████████  ██  ██  ██     │
│    ██  ██  ██      ██  ██  ██  ██   │
│    ██  ██  ████████  ██  ██  ██     │
│    ██                        ██     │
│    ██████████████████████████████   │
│                                     │
│    Can't scan? Enter this code:     │
│    XXXX XXXX XXXX XXXX              │
└─────────────────────────────────────┘
  1. Enter the 6-digit code from your app
  2. Save your backup codes (shown only once!)
  3. Click Enable

Using SMS (Less Secure)​

Security Note

SMS 2FA is vulnerable to SIM swapping attacks. We recommend using an authenticator app instead.

  1. Go to Settings → Security → Two-Factor Authentication
  2. Click Enable 2FA
  3. Select SMS
  4. Enter your phone number
  5. Enter verification code received via SMS
  6. Save your backup codes
  7. Click Enable

Logging In with 2FA​

Normal Login​

  1. Enter email and password
  2. Enter 6-digit code from authenticator app
  3. Click Verify
┌─────────────────────────────────────┐
│ Two-Factor Authentication           │
├─────────────────────────────────────┤
│                                     │
│ Enter the 6-digit code from your    │
│ authenticator app:                  │
│                                     │
│   ┌───┐ ┌───┐ ┌───┐ ┌───┐ ┌───┐ ┌───┐ │
│   │   │ │   │ │   │ │   │ │   │ │   │ │
│   └───┘ └───┘ └───┘ └───┘ └───┘ └───┘ │
│                                     │
│   [Verify]                          │
│                                     │
│   Lost access? Use backup code      │
└─────────────────────────────────────┘

Using Backup Code​

If you can't access your authenticator:

  1. Click Use backup code on 2FA screen
  2. Enter one of your backup codes
  3. Click Verify
One-Time Use

Each backup code works only once. After use, it's invalid.

Managing 2FA​

View 2FA Status​

Go to Settings → Security → Two-Factor Authentication:

┌─────────────────────────────────────┐
│ Two-Factor Authentication           │
├─────────────────────────────────────┤
│ Status: ✅ Enabled                  │
│ Method: Authenticator App           │
│ Enabled: January 1, 2026            │
│                                     │
│ [View Backup Codes] [Disable 2FA]   │
└─────────────────────────────────────┘

Regenerate Backup Codes​

If you've used backup codes or want new ones:

  1. Go to Settings → Security → Two-Factor Authentication
  2. Click View Backup Codes
  3. Enter your current 2FA code
  4. Click Regenerate Codes
  5. Save new codes securely

Old codes become invalid when you regenerate.

Change 2FA Method​

To switch from SMS to Authenticator (or vice versa):

  1. Disable current 2FA method
  2. Enable new method
  3. New backup codes are generated

Disable 2FA​

Security Risk

Disabling 2FA reduces account security. Only disable if absolutely necessary.

  1. Go to Settings → Security → Two-Factor Authentication
  2. Click Disable 2FA
  3. Enter your password
  4. Enter current 2FA code
  5. Confirm action

Recovery Options​

Lost Authenticator Device​

If you have backup codes:

  1. Login with email/password
  2. Use a backup code
  3. Set up 2FA on new device

If you don't have backup codes:

  1. Contact 1@az1.ai
  2. Verify identity (requires photo ID)
  3. Support will disable 2FA after verification
  4. Set up 2FA again immediately

Lost Phone Number (SMS 2FA)​

  1. Contact 1@az1.ai
  2. Verify identity
  3. Update phone number after verification

Best Practices​

Choosing a Method​

MethodSecurityConvenience
Authenticator App⭐⭐⭐⭐⭐⭐
Hardware Key (future)⭐⭐⭐⭐⭐⭐
SMS⭐⭐⭐⭐⭐

Storing Backup Codes​

Do:

  • Store in password manager
  • Print and keep in secure location
  • Store in encrypted file

Don't:

  • Save in unencrypted notes
  • Store on device without protection
  • Share with others
AppPlatformFeatures
1PasswordAllPassword manager + TOTP
AuthyAllCloud backup, multi-device
Google AuthenticatoriOS, AndroidSimple, no account needed
Microsoft AuthenticatorAllEnterprise features

Organization Requirements​

Requiring 2FA for Members​

Org admins can require 2FA:

  1. Go to Organization → Settings → Security
  2. Enable Require 2FA for all members
  3. Set grace period (7/14/30 days)

Members without 2FA will:

  • See reminder on login
  • Be required to set up 2FA after grace period
  • Lose access if not compliant

Checking Team Compliance​

View 2FA status for all members:

  1. Go to Organization → Members
  2. Filter by 2FA Status:
    • ✅ Enabled
    • ⚠️ Not enabled
    • ⏳ Grace period

Enforcement Timeline​

DayAction
0Requirement enabled
0-7Reminder on login
7Daily email reminders
Grace period endAccess restricted until 2FA enabled

Troubleshooting​

Code Not Working​

  1. Check time sync - Your device clock must be accurate
  2. Wait for new code - Codes refresh every 30 seconds
  3. Verify correct account - Check app shows "CODITECT"
  4. Try backup code - If issue persists

Time Sync Issues​

Authenticator apps use time-based codes. If your clock is off:

Android:

  1. Settings → Date & Time
  2. Enable "Automatic date & time"

iOS:

  1. Settings → General → Date & Time
  2. Enable "Set Automatically"

Multiple Accounts​

If you have multiple CODITECT accounts:

  • Each needs separate 2FA setup
  • Authenticator will show multiple entries
  • Label accounts clearly in app

Security Considerations​

Why 2FA Matters​

AttackWithout 2FAWith 2FA
Password leak❌ Vulnerable✅ Protected
Phishing❌ Vulnerable⚠️ Partially protected
Brute force❌ Vulnerable✅ Protected
SIM swapN/A⚠️ SMS vulnerable

Limitations​

2FA protects against:

  • ✅ Password theft
  • ✅ Credential stuffing
  • ✅ Most phishing attacks

2FA doesn't protect against:

  • ❌ Malware on your device
  • ❌ Real-time phishing (rare)
  • ❌ Physical access to unlocked device