> ## Documentation Index
> Fetch the complete documentation index at: https://help.cloudtalk.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Two-Factor Authentication (2FA)

> Protect your CloudTalk account with a second step after your password: a passkey, an authenticator app, or an email code.

> [!NOTE]
>
> Two-factor authentication (2FA) adds a second step after your password, so a stolen password alone can't get into your CloudTalk account. You confirm it's you with a passkey, an authenticator app, or a code sent to your email.

**User level:** Admin, Agent

***

## How it works

When you sign in with your password on a new device, CloudTalk asks for a second step. Once you pass it, you can trust that device for 30 days, so you aren't asked again every time.

You only do this once per device. The same sign-in covers the Dashboard, CloudTalk Phone on desktop and mobile, the Click-to-Call extension, Microsoft Teams, and the CloudTalk dialer inside your CRM.

If your company requires two-factor authentication, you set up your first method when you sign in: during onboarding for new CloudTalk accounts, or at your next sign-in after an admin turns it on.

> [!NOTE]
>
> If you sign in with **SSO** (Google, Microsoft, Okta, or another identity provider), CloudTalk doesn't ask for a second step. Your identity provider handles it.

## Choose a method

| **Method** | **How you confirm it's you** |
| - | - |
| **Passkey** (recommended) | Touch ID, Face ID, or your device PIN. Nothing to type, and it can't be phished. |
| **Authenticator app** | A 6-digit code from an app like Google Authenticator, 1Password, or Authy. The code changes every 30 seconds. |
| **Email code** | A 6-digit code sent to your inbox. It expires after 10 minutes. |

You can set up more than one. When you sign in, CloudTalk starts with your strongest method (passkey, then authenticator app, then email) and lets you choose another one if it doesn't work.

### The email code is always your backup

If you've set up a passkey or an authenticator app, you can also sign in with an email code, even if you never set up email.

* While 2FA is on, the email code can't be removed. On your Profile, it shows as **Always available**.
* If you remove your last passkey or authenticator app, 2FA stays on, with the email code as your method.

> [!WARNING]
>
> **Exception: companies that allow strong methods only.** If your company has turned on **Strong methods only**, there's no email code at all, neither as a backup nor as a method. On your Profile, email shows as **Off for this account**, and you can't remove your last passkey or authenticator app until you've added another one.

## Set up two-factor authentication

1. Click **Profile** at the bottom of the left-hand menu.
2. Scroll to **Two-factor authentication**.
3. Click **Set up** next to the method you want. A CloudTalk sign-in page opens.
4. Follow the steps for your method (below). When you're done, you return to your Profile and get a confirmation email.

> [!NOTE]
>
> For your security, you need to have signed in within the last 5 minutes to set up or change a method. If it's been longer, CloudTalk asks you to sign in again and then brings you back.

### Passkey

1. Your device asks for your fingerprint, face, or PIN. Confirm it.
2. The passkey is saved on that device.
3. CloudTalk suggests adding a second passkey on your phone. Scan the code with your phone's camera and confirm there. If you lose one device, the other passkey still gets you in.

### Authenticator app

1. Open your authenticator app and choose **Add account**.
2. Scan the QR code, or type in the key shown below it.
3. Enter the 6-digit code the app shows, and click **Turn on authenticator**.

### Email code

1. Click **Continue**. CloudTalk sends a 6-digit code to your email.
2. Enter the code to confirm the inbox is yours.

## Sign in with two-factor authentication

1. Enter your email and password as usual.
2. On a new or untrusted device, confirm it's you with your method: approve the passkey prompt, or enter the 6-digit code.
3. Tick **Trust this device for 30 days** if it's your own device. Don't tick it on shared or public computers.

With a passkey, you can also click **Sign in with passkey** on the sign-in page and skip the password altogether.

### Trusted devices

* A trusted device skips the second step for 30 days. Each time you use it, the 30 days start again, up to 90 days in total. After that, CloudTalk asks for your second step once more.
* On a shared computer, everyone has their own trust: one person trusting it doesn't skip the step for anyone else.
* Signing out, removing a method, or turning off two-factor authentication doesn't end trust: devices you've already trusted keep skipping the second step. For everything that does end trust, see [I'm asked for the second step again](https://help.cloudtalk.io/en/articles/troubleshooting-two-factor-authentication.md#im-asked-for-the-second-step-again).

### See and remove your trusted devices

1. Go to **Profile > Two-factor authentication > Trusted devices**.
2. Click **Manage trusted devices**. You see every device you've trusted. The one you're using now is tagged **This device**.
3. Remove any device, including this one, or click **Remove all except this device**.

## Manage your methods

You can add or remove methods anytime from **Profile > Two-factor authentication**. To switch methods, add the new one first, then remove the old one.

## Turn off two-factor authentication

If your company doesn't require two-factor authentication, you can turn it off yourself:

1. Go to **Profile > Two-factor authentication**.
2. Under your methods, click **Turn off two-factor authentication**. If you signed in more than 5 minutes ago, CloudTalk asks you to sign in again first.

This removes all your methods, the email code included. Your trusted devices stay trusted. You get a "Two-factor authentication was turned off" email, and the change appears in your admins' Activity log.

You don't see the **Turn off two-factor authentication** link when:

* **you haven't set up a method yet:** there's nothing to turn off, so you only see **Set up** next to each method;
* **your company requires two-factor authentication:** your Profile shows *"Your account requires two-factor authentication, so this cannot be turned off."*;
* **you sign in with SSO only:** you see the SSO notice instead of the two-factor settings.

Only you can turn off two-factor authentication for your account. Admins can't turn it off for someone else: they can only reset it.

## Security emails

CloudTalk emails you when something changes on your account, for example when 2FA is turned on or off, a method is added or removed, an admin resets your 2FA, or someone signs in from a new device.

If you get a **new sign-in** email and it wasn't you, click **This wasn't me** and confirm. CloudTalk signs out every session, removes all trusted devices, and asks you to create a new password. Your 2FA methods stay as they are.

## Related articles

* [Require Two-Factor Authentication for Your Account](https://help.cloudtalk.io/en/articles/require-two-factor-authentication.md) (for admins)
* [Troubleshooting: Can't Sign In with Two-Factor Authentication](https://help.cloudtalk.io/en/articles/troubleshooting-two-factor-authentication.md)

***

*Need help or have a question?* Just reach out through our [Support portal](https://support.cloudtalk.io/hc/en-us/requests/new?ticket_form_id=26305535257884). We're here for you.


## Related topics

- [Require Two-Factor Authentication for Your Account](https://help.cloudtalk.io/en/articles/require-two-factor-authentication.md)
- [Troubleshooting: Can't Sign In with Two-Factor Authentication](https://help.cloudtalk.io/en/articles/troubleshooting-two-factor-authentication.md)
- [Limitations receiving OTP and 2FA SMS messages](https://help.cloudtalk.io/en/articles/11403518-limitations-receiving-otp-and-2fa-sms-messages.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.