Your alert history deserves more than a password.
TOTP two-factor authentication with single-use recovery codes, enforced on the dashboard and in the app. Your API keys and scripts carry on untouched.
Real 2FA, without breaking your scripts
Your notification history is a log of what your systems do and when they break. That is worth more than one password.
Works with any authenticator
Standard TOTP. Scan the QR code with whichever authenticator you already use and confirm one code to switch it on.
Covers web and mobile
Enforced on both the web dashboard and the mobile app after the primary login, so there is no soft side door.
Recovery codes that hold up
Single-use recovery codes are issued at setup and consumed atomically, so two parallel logins cannot spend the same one.
Automation stays untouched
API keys are never challenged. Your automation keeps working exactly as it did the day before you enabled 2FA.
Safe to re-enroll
A new enrollment sits in a pending slot until you confirm it, so an interrupted setup cannot lock you out of your own account.
Brute-force protection
Five wrong codes lock the account for fifteen minutes, and you get an email whenever 2FA is switched on or off.
Set up in two minutes
Scan the code
Open Account → Security and scan the QR code with your authenticator app.
Confirm once
Enter one six-digit code to confirm. 2FA only switches on after a correct code.
Store the backups
Save the recovery codes somewhere other than the phone running the authenticator.
Turning it on
Open Account → Security and start the setup. You get a QR code and a secret to scan with any TOTP authenticator, then confirm one six-digit code. Only after a correct code does 2FA actually switch on, and only then are your recovery codes shown. Save them somewhere that is not the phone running the authenticator.
What changes at login
On the dashboard and in the app, a correct password now leads to a code prompt rather than straight into your account. Under the hood the login endpoint returns a short-lived challenge instead of a token, and a second call exchanges that challenge plus your code for the real session. Challenges expire after five minutes.
The code field takes either a six-digit TOTP code or one of your recovery codes, so losing your phone is an inconvenience rather than a lockout.
What does not change
API keys are not part of this. They authenticate with the Token header and are never challenged, which means every script, cron job and CI pipeline you have keeps sending alerts exactly as before. This is also the argument for issuing a separate key per service: revoking one leaves the rest alone.
Questions, answered
Any standard TOTP app: Google Authenticator, 1Password, Authy, Bitwarden, and anything else that scans a QR code and produces six-digit codes.
No. 2FA applies to interactive logins on the dashboard and in the mobile app. API keys authenticate with the Token header and are never challenged, so your cron jobs, CI pipelines and monitoring hooks keep sending alerts untouched.
Use one of your recovery codes in place of the six-digit code. Each one works once. You can generate a fresh set at any time from Account → Security, which invalidates the old ones.
It does not touch the 2FA you already have. The new secret sits in a pending slot and only replaces the active one once you confirm a code, so closing the tab halfway through cannot lock you out.
Login returns a short-lived challenge instead of a token, and you exchange that challenge plus a code for the real JWT. Challenges live for five minutes. The code field accepts either a TOTP code or a recovery code.
Five failed codes lock the account for fifteen minutes and further attempts return 429. You also get an email whenever 2FA is enabled or disabled — if one arrives and it was not you, change your password immediately.
Two minutes now, one less thing to worry about
Scan a QR code, save the recovery codes, and a stolen password stops being enough to read your alerts.