# Sign-in and two-factor authentication

Every sign-in to the Blink console needs a password and a second factor: a passkey, or a 6-digit code from an authenticator app. Two-factor authentication is always on and can't be turned off. Anyone who hasn't set it up yet is asked to at their next sign-in.

You manage your own sign-in on the **Account** page, under **You** in the console sidebar.

## Set up two-factor authentication

You set up two-factor when you first sign in from an invite link, or after an instance owner resets your sign-in.

1. On the **Set up two-factor** screen, add the key to an authenticator app such as Google Authenticator, 1Password or Authy. Select **Open in authenticator**, or select **Copy key** and paste the **Setup key** into the app.
2. Enter the **6-digit code** the app shows.
3. Select **Verify and enable**.
4. Blink shows your recovery codes. Save them somewhere safe, then select **I've saved them, continue**.

## Recovery codes

You get 10 recovery codes. Each one works once, in place of a 6-digit code, if you lose your authenticator app. The **Account** page shows how many you have left.

To get a new set:

1. Open **Account**.
2. Under **Two-factor authentication**, select **New recovery codes**.
3. Enter the 6-digit code from your authenticator app and select **Make new codes**.
4. Save the new codes, then select **I've saved them**.

Your old codes stop working, and the new ones are not shown again.

## Passkeys

A passkey lets you sign in and confirm high-risk actions with your fingerprint, face, screen lock or a security key instead of typing a code. Passkeys can't be phished. Your authenticator app stays as the fallback.

To add a passkey:

1. Open **Account**.
2. Under **Passkeys**, select **Add passkey**.
3. Enter a **Name**, for example the name of the laptop or security key, and select **Continue**.
4. Follow your browser's prompt.

To remove a passkey, select the bin icon next to it. When you sign in with a passkey available, you can still choose **Use a code from your authenticator app instead**.

## Sign out everywhere

If you think a computer or phone you used was lost or stolen, open **Account** and select **Sign out of all devices**. **Sign out** signs out only the browser you are using.

## Lost authenticator or forgotten password

Users can't change their own password or remove two-factor in the console. If you have no recovery codes left, or forgot your password, ask an instance owner to reset your sign-in. They send you a new link to choose a password and set up two-factor again. See [Reset a user's sign-in](/configure/users/#reset-a-users-sign-in).

## How long a sign-in lasts

A console sign-in lasts 30 days by default. After that, the browser has to sign in again with password and second factor, however active it was. Someone with the **Manage security settings** permission can change this to anything from 1 to 365 days. See [Sign-in lifetime](/configure/security-settings/#sign-in-lifetime).

## Confirming high-risk actions

Some actions ask for a fresh passkey or 6-digit code even though you are signed in, so a stolen sign-in alone can't do them. These include opening a terminal, Backstage tools as SYSTEM, a Safe Mode reboot, Install Access, changes to roles, members, users and two-factor, changes to security settings, revoking or deleting a device, and changes to the instance identity and keys.

How long one confirmation lasts is an instance setting. See [Confirming high-risk actions](/configure/security-settings/#confirming-high-risk-actions).

## Too many wrong attempts

Blink limits wrong passwords and wrong two-factor codes. Too many wrong codes for one account lock that account for a while, from every address except allowlisted ones. Too many wrong passwords lock that email from that address only, so nobody can lock you out from somewhere else. See [Rate limits](/configure/security-settings/#rate-limits).