Two-factor authentication

Two-factor authentication asks for a 6-digit code from an authenticator app each time you sign in with Continue with Google or an email link. Someone who gets into your Google account or inbox still can’t open Lightfield without your phone.

Who can use it

Anyone can set up an authenticator app for their own account, on every plan and in every role.

Requiring two-factor authentication for the whole workspace is on Pro, Growth and Enterprise, and only workspace owners can turn it on. Earlier plans can differ. Check your workspace’s available features.

Single sign-on (SSO) sign-ins never ask for a Lightfield code. Your identity provider’s own MFA protects them instead.

Set up your authenticator app

You need an authenticator app on your phone that shows 6-digit codes.

1. Go to Settings → Security. Under Two-factor authentication, Authenticator app shows Not set up.
2. Click Set up.
3. Scan the QR code with your authenticator app, or type the key shown below it.
4. Enter the 6-digit code your app shows and click Verify.
5. Save your recovery codes: click Download codes, or store them somewhere safe, then click Done.

Authenticator app now shows Enabled. From your next sign-in, Lightfield asks for a code after Google or your email link.

Each recovery code works once. Keep them somewhere other than your phone, so you can still sign in if you lose it.

If the dialog says An authenticator app is already registered, enter a code from that app to finish. If you no longer have it, click Start over to get a new QR code.

Sign in with a code

1. Sign in with Continue with Google or your email link as usual.
2. On Enter your verification code, open your authenticator app and enter the 6-digit code for Lightfield.

If your phone isn’t with you, click Use a recovery code instead and enter one of your saved codes.

Manage your authenticator app

Both actions are in Settings → Security, and both ask for a current code from your app or a recovery code, so someone using your open session can’t turn two-factor off.

• Get new recovery codes: next to Recovery codes, click Regenerate. Your old codes stop working, so save the new ones.
• Turn two-factor off: next to Authenticator app, click Remove. You won’t be asked for a code at sign-in, and your recovery codes stop working. You can’t remove it while your workspace requires two-factor authentication.

Require two-factor for your workspace

Turn on your own authenticator app first; Lightfield won’t let you require it until you have.

1. Go to Settings → Workspace Security.
2. Under Two-factor authentication, next to Require for all members, pick an Enforcement date. It starts two weeks out and must be in the future.
3. Click Require.

You see Two-factor policy updated, and the row reads Required from your date.

Two weeks gives most teams time to set up without anyone getting locked out mid-task. Until the date, members who haven’t set up an authenticator app see a banner with a Set up button. After it, Lightfield signs them out, and at their next sign-in they must set one up before they can continue.

Under Members, Authenticator app set up shows how many members have finished, for example 4 of 6 members. Click View members to see who: members with an app show a 2FA badge in Settings → Members.

To stop requiring it, click Make optional.

Once the date passes, people can’t join the workspace by email domain; invite them from Members instead. Workspaces where every sign-in uses SSO aren’t affected by the requirement.

Reset a teammate’s two-factor

If a teammate loses their phone and their recovery codes, a workspace owner can reset them:

1. In Settings → Members, open their role menu and choose Reset two-factor.
2. Confirm in Reset two-factor for [name]?.

This removes their authenticator app and signs them out on every device. If the workspace requires two-factor, they set up a new app at their next sign-in. Owners can’t reset another owner; a locked-out owner should email support@lightfield.app.

Troubleshooting

“That code didn’t work. Try again.”

Enter the code your app shows for Lightfield right now, before it changes. If codes keep failing, check that your phone sets its date and time automatically: authenticator codes depend on the clock. You can also click Use a recovery code instead.

“Your sign-in expired. Please sign in again.”

The sign-in waiting for your code ended. Click Back to sign in and start again with Google or your email link.

I lost my phone

Sign in with a recovery code, then set up your new phone: in Settings → Security, remove the old app and set up again, or regenerate your codes if you only lost those. Without a recovery code, ask a workspace owner to reset your two-factor.

“This workspace requires two-factor authentication. Ask a workspace admin to invite you.”

The workspace requires two-factor, so it doesn’t let people join by email domain. Ask an owner or admin to send you an invitation.

Common questions

Does a reset delete anything? No. It removes the authenticator app and signs the person out. Their records, mail and settings stay as they were.