Skip to content
Get started →
Contents

Two-factor authentication and passkeys

Last Updated: September 30, 2026

What it does

Two-Factor Authentication sits on the profile page, under Change Password. A badge at the top of the panel says whether a second factor is set. With none set, the panel offers Enable 2FA. With one set, the Authenticator App row reads Enabled or Not configured and offers Enable or Disable beside it.

Passkeys is the second half of the panel. It lists each registered passkey by name with the date it was last used, and offers Add Passkey. A passkey signs you in without a password and counts as a second factor.

Backup codes are issued by the authenticator enrolment and by your first passkey, and appear once. Copy and Download are beside them, and that step closes only when you select I’ve Saved These Codes.

Before you start

If you signed up through Google, you have no password. Those steps skip asking for one.

If you have a password, you need to enter it before adding or removing a factor. That includes deleting a passkey and turning off the authenticator app.

The Passkeys section only shows up in a browser that supports passkeys.

You can only see your backup codes while the setup panel is open - save them then, because you will not see them again. Each code works once.

Turning off the authenticator app removes it from your account. Setting it up again gives you a new set of backup codes.

How to use it

  1. Open Settings, then Profile, and scroll to Two-Factor Authentication.
  2. Select Enable 2FA. Enter your account password if you are asked for it.
  3. Scan the QR code with your authenticator app, or copy the code shown beneath it.
  4. Select Enter Code, type the six-digit code, and select Verify.
  5. Copy or download the backup codes, then select I’ve Saved These Codes.
  6. To add a passkey, select Add Passkey, give the device a name, and follow your browser’s prompt.

Troubleshooting

If Lucrii cannot check your two-factor status, the panel says so and treats your account as one that needs a password. That way, you are never asked to fill in a password field you do not have.

  • Your profile: Your name, email, picture, personal email signature and password are all on the profile page.
  • Members and invitations: The members page lists everyone in the organisation, with the invitations, role changes and access revocations beside them.

Changes