---
title: Two-factor authentication | Lightfield
description: Protect your Lightfield sign-in with an authenticator app, and require two-factor authentication for everyone in your workspace.
---

Two-factor authentication asks for a 6-digit code from an authenticator app each time you sign in with **Continue with Google** or an email link. Someone who gets into your Google account or inbox still can’t open Lightfield without your phone.

## Who can use it

Anyone can set up an authenticator app for their own account, on every plan and in every role.

Requiring two-factor authentication for the whole workspace is on Pro, Growth and Enterprise, and only workspace owners can turn it on. Earlier plans can differ. [Check your workspace’s available features](/help/missing-feature/index.md).

[Single sign-on (SSO)](/help/settings/security/sso/index.md) sign-ins never ask for a Lightfield code. Your identity provider’s own MFA protects them instead.

## Set up your authenticator app

You need an authenticator app on your phone that shows 6-digit codes.

1. Go to [Settings → Security](https://crm.lightfield.app/crm/settings/security/). Under **Two-factor authentication**, **Authenticator app** shows **Not set up**.
2. Click **Set up**.
3. Scan the QR code with your authenticator app, or type the key shown below it.
4. Enter the 6-digit code your app shows and click **Verify**.
5. Save your recovery codes: click **Download codes**, or store them somewhere safe, then click **Done**.

**Authenticator app** now shows **Enabled**. From your next sign-in, Lightfield asks for a code after Google or your email link.

Each recovery code works once. Keep them somewhere other than your phone, so you can still sign in if you lose it.

If the dialog says **An authenticator app is already registered**, enter a code from that app to finish. If you no longer have it, click **Start over** to get a new QR code.

## Sign in with a code

1. Sign in with **Continue with Google** or your email link as usual.
2. On **Enter your verification code**, open your authenticator app and enter the 6-digit code for Lightfield.

If your phone isn’t with you, click **Use a recovery code instead** and enter one of your saved codes.

## Manage your authenticator app

Both actions are in [Settings → Security](https://crm.lightfield.app/crm/settings/security/), and both ask for a current code from your app or a recovery code, so someone using your open session can’t turn two-factor off.

- **Get new recovery codes:** next to **Recovery codes**, click **Regenerate**. Your old codes stop working, so save the new ones.
- **Turn two-factor off:** next to **Authenticator app**, click **Remove**. You won’t be asked for a code at sign-in, and your recovery codes stop working. You can’t remove it while your workspace requires two-factor authentication.

## Require two-factor for your workspace

Turn on your own authenticator app first; Lightfield won’t let you require it until you have.

1. Go to [Settings → Workspace Security](https://crm.lightfield.app/crm/settings/workspace-security/).
2. Under **Two-factor authentication**, next to **Require for all members**, pick an **Enforcement date**. It starts two weeks out and must be in the future.
3. Click **Require**.

You see **Two-factor policy updated**, and the row reads **Required from** your date.

Two weeks gives most teams time to set up without anyone getting locked out mid-task. Until the date, members who haven’t set up an authenticator app see a banner with a **Set up** button. After it, Lightfield signs them out, and at their next sign-in they must set one up before they can continue.

Under **Members**, **Authenticator app set up** shows how many members have finished, for example **4 of 6 members**. Click **View members** to see who: members with an app show a **2FA** badge in [Settings → Members](https://crm.lightfield.app/crm/settings/members/).

To stop requiring it, click **Make optional**.

Once the date passes, people can’t join the workspace by email domain; invite them from [Members](/help/settings/members/index.md#invite-teammates) instead. Workspaces where every sign-in uses SSO aren’t affected by the requirement.

## Reset a teammate’s two-factor

If a teammate loses their phone and their recovery codes, a workspace owner can reset them:

1. In [Settings → Members](https://crm.lightfield.app/crm/settings/members/), open their role menu and choose **Reset two-factor**.
2. Confirm in **Reset two-factor for \[name]?**.

This removes their authenticator app and signs them out on every device. If the workspace requires two-factor, they set up a new app at their next sign-in. Owners can’t reset another owner; a locked-out owner should email <support@lightfield.app>.

## Troubleshooting

### “That code didn’t work. Try again.”

Enter the code your app shows for Lightfield right now, before it changes. If codes keep failing, check that your phone sets its date and time automatically: authenticator codes depend on the clock. You can also click **Use a recovery code instead**.

### “Your sign-in expired. Please sign in again.”

The sign-in waiting for your code ended. Click **Back to sign in** and start again with Google or your email link.

### I lost my phone

Sign in with a recovery code, then set up your new phone: in [Settings → Security](https://crm.lightfield.app/crm/settings/security/), remove the old app and set up again, or regenerate your codes if you only lost those. Without a recovery code, ask a workspace owner to [reset your two-factor](#reset-a-teammates-two-factor).

### “This workspace requires two-factor authentication. Ask a workspace admin to invite you.”

The workspace requires two-factor, so it doesn’t let people join by email domain. Ask an owner or admin to send you an invitation.

## Common questions

**Does a reset delete anything?** No. It removes the authenticator app and signs the person out. Their records, mail and settings stay as they were.