Two-factor authentication
Add a second step to every sign-in with an authenticator app or email code
Two-factor authentication (2FA) is opt-in for every user. Once enabled, signing in takes a password plus a second, short-lived code — so a leaked password alone isn't enough to get in.
Choosing a method
At enrollment, pick one of two methods:
- Authenticator app (TOTP) — scan a QR code with an app like Google Authenticator or Authy, then enter the six-digit code it generates to confirm setup. Once confirmed, 10 one-time backup codes are shown — this is the only time you'll see them, so store them somewhere safe.
- Email code — a one-time code is emailed to you at sign-in. Simpler to set up, but there are no backup codes with this method; losing access to the mailbox means losing access to this factor.
Signing in
After your password, a second step asks for the current code. TOTP users who don't have their app handy can enter one of their backup codes instead — each backup code works once.
Managing 2FA
Enroll, switch methods, or disable 2FA from Settings → Security. Disabling requires entering a current code first, so a session hijacked after login can't turn 2FA off on its own.
Recovery
Locked out — lost the authenticator, used up your backup codes, or lost access to the 2FA email? Contact Bitelio support to reset your 2FA so you can sign in and re-enroll. Resetting another person's 2FA is a platform-support action; a project's own Owners and Admins cannot reset a teammate's 2FA from the dashboard. Note that email-code 2FA depends on the platform's email notifications being configured; if you're unsure whether that's the case in your environment, the authenticator app method has no such dependency.