# Account security (/docs/getting-started/account-security)

Open the menu under your name at the bottom of the sidebar and choose **Security**. Everything there applies to your account in every organization you belong to.

## Passkeys [#passkeys]

A passkey lets you sign in with your fingerprint, face, device PIN or a security key instead of a password. It's tied to Datahop's domain, so a phishing site can't use it.

- **Add one:** click **Add passkey**, name it (for example "MacBook" or "YubiKey"), then confirm on your device. Add one for each device or password manager you use.
- **Sign in:** click **Sign in with a passkey** on the sign-in page, or pick the passkey from the email field's autofill suggestions.
- **Remove one:** click **Delete** next to it. Also delete it from your device or password manager.

Passkey sign-in never asks for a two-factor code. The passkey already proves you have the device and can unlock it.

## Two-factor authentication [#two-factor-authentication]

Two-factor authentication (2FA) asks for a 6-digit code from an authenticator app (1Password, Google Authenticator, Authy…) whenever you sign in with your password.

<Steps>

### Turn it on [#turn-it-on]

Click **Turn on two-factor** and confirm your password.

### Scan the QR code [#scan-the-qr-code]

Scan it with your authenticator app, or type in the key shown next to it. Then enter the 6-digit code from the app.

### Save your backup codes [#save-your-backup-codes]

You get ten backup codes, shown once. Copy or download them and keep them somewhere safe, such as your password manager. Each code signs you in once if you lose your phone.

</Steps>

When you sign in with your password, Datahop then asks for the code. Tick **Trust this device for 30 days** to skip the code on that browser for the next 30 days. Click **Use a backup code instead** if you don't have your phone.

**Regenerate backup codes** replaces all of your codes with ten new ones. **Turn off** disables 2FA. Both ask for your password.

<Callout type="warn" title="Lost your phone and your backup codes?">
  Sign in with a passkey if you have one, then turn two-factor off and on again to set up a new phone. If you have neither, ask the person who runs your Datahop instance to reset your account.
</Callout>

API keys (`dh_sk_…`) and MCP connections aren't affected. They authenticate with the key, not your sign-in.