Two-factor authentication
Two-factor authentication (2FA) adds a second step at sign-in: a 6-digit code from an authenticator app on your phone. Even if someone learns your password, they cannot get in without your device.
Turn it on in Account settings → Sign-in methods → Two-factor authentication.
Setting it up
- Click Set up. Canopy shows a QR code.
- Scan it with an authenticator app - Google Authenticator, 1Password, Authy, or Apple Passwords all work. (Can't scan? Type the setup key shown underneath into your app by hand.)
- Enter the 6-digit code your app displays to confirm it works.
- Save your recovery codes. They are shown once - see below.
From then on, every sign-in asks for the current code, including sign-ins with GitHub. Otherwise "Sign in with GitHub" would be a way around your own setting.
The codes are calculated, not sent
Your app is not receiving a message - it is computing the same number Canopy computes, from a shared key and the current time. Nothing to intercept, and it works offline. Codes change every 30 seconds; if yours keeps being rejected, check that your phone's clock is set automatically.
Recovery codes
When you turn 2FA on, Canopy issues 10 single-use recovery codes. They are your way back in if you lose your phone, so save them somewhere safe and offline
-
a password manager, or printed and put away.
-
Each code works once.
-
Using one signs you in and turns 2FA off, so you can set up a new authenticator app. It is a reset, not a bypass - there is no way to produce a valid app code without the device.
-
Redeeming a code retires the whole sheet. When you set two-factor up again you get ten brand-new codes, and the old page stops working. So the ten are redundancy against a code that is lost, damaged or mistyped - not ten separate recoveries.
-
Anyone holding a code can do the same, so treat them like passwords.
-
You can issue a fresh set at any time from the same card ("Regenerate"). The old ones stop working immediately.
Canopy stores only one-way hashes of your codes, so we cannot show them to you again - only replace them. If you lose both your phone and your codes, contact support.
Lost your phone?
On the code screen, choose Lost your device? and enter a recovery code. That signs you in, removes the old authenticator, and prompts you to enroll a new one.
Turning it off
Turn 2FA off from the same settings card. It asks for your password first, and we email you either way - a change this significant should never happen silently, and that email is your signal if it wasn't you.
Why not codes by email?
Canopy deliberately does not offer emailed sign-in codes. Password resets already run through your inbox, so a mailbox is already enough to get into an account - an emailed second factor would be a second lock keyed to the same door. An authenticator app is a genuinely separate factor, and it is the one security standards (NIST SP 800-63B) actually recognise.
How it's enforced
The second factor is not just a screen you have to get past. Once you enroll, your session carries a signed assurance level, and Canopy's database policies require it: a session that skipped the code can read nothing, even if someone bypassed the app entirely and queried the API directly.
Where to go next
- Best practices - including how to protect API and MCP tokens.
- Accounts - sign-in methods, handles, and account deletion.