Two-step verification

Two-step verification adds a code from an authenticator app to password sign-in. Anyone can turn it on for their own account, and admins can require it for the workspace.

Any app that supports time-based codes works, such as Google Authenticator, Microsoft Authenticator, 1Password or Authy. Forgebench never sends codes by email or text.

People who sign in through SSO aren't asked for a Forgebench code. Turn on MFA in your identity provider's sign-on policy instead.

Set it up

1. Settings → Security → Set up

   Under Your sign-in, click Set up on the Two-step verification row. The Set up two-step verification dialog opens at step 1 of 2, with a QR code.

2. Scan the QR code

   In your authenticator app, add an account and scan the code. It shows up as Forgebench with your email. If you can't scan it, type the key shown under Can't scan? Enter this key instead into the app, as a time-based key.

3. Enter the 6-digit code

   Type the code the app shows and click Turn on.

4. Save your recovery codes

   Step 2 shows 10 recovery codes. Each one signs you in once if you lose your phone. Click Copy or Download and keep them somewhere safe, such as a password manager. They are shown only this once, so Done stays disabled until you tick I've saved my recovery codes.

If your workspace requires it and you haven't set it up, these steps appear after your password at your next sign-in.

Signing in

After your password, enter the 6-digit code from your app and click Verify. Codes change every 30 seconds and work once; if one is refused, wait for the next.

Lost your phone? Click Use a recovery code and enter a saved code. Each works once. Once you're in, set up your app again.

The Forgebench CLI asks for the code in the browser window its login opens.

Manage it

Go to Settings → Security → Your sign-in. The Recovery codes row shows how many codes you have left, highlighted when 3 or fewer remain. Each action below first asks for a code from your app or a recovery code.

Require it for your workspace

Admins use the Require two-step verification switch under Settings → Security → Everyone in this workspace. The confirmation shows how many members haven't set it up, with a See members link. Click Require it to turn it on, or Stop requiring to turn it off.

• Set it up for yourself first. Until you do, the switch is disabled and reads Set up yours first.
• Members without it are asked to set it up at their next sign-in.
• Sessions without a second step end straight away, including ones already open. People sign in again and add the code.
• Members can't turn theirs off while the policy is on.
• SSO sign-ins aren't affected: they rely on your identity provider's MFA.
• Each workspace has its own. Switching to another workspace that requires two-step verification asks for that workspace's code.

Reset a member's two-step verification

If someone loses their phone and recovery codes, go to Members, open their menu, choose Reset two-step verification, and confirm. Their app and recovery codes stop working and they're signed out everywhere. If the workspace requires it, they set it up again at next sign-in.

The option appears only for people who have it set up, and not for yourself.

Too many wrong codes

A correct code resets the count. If you didn't type those codes, someone has your password: change it.

Security emails

Forgebench emails you when any of these happen:

• two-step verification was set up, or turned off
• an admin reset it
• you signed in with a recovery code (with how many you have left)
• new recovery codes were created
• sign-in was paused, or the app locked, after wrong codes

Each email says what happened, when, and what to do if it wasn't you.

Audit log

Each event is recorded in the audit log with who did it and for whom:

Troubleshooting

Next