# Sign-in and security > Sign in with a password or Google, GitHub, Microsoft or Atlassian, set up MFA with an authenticator app, passkey or text message, and require it for your team. Source: https://www.apitraffic.io/docs/account/security Protect your account with more than a password. You can sign in with a password or a social provider, add a second factor (an authenticator app, a passkey or a text message), and require every teammate to use one. Your sign-in methods and second factors belong to you, not to the account: they follow you to every ApiTraffic account you're a member of. The account-wide MFA requirement is set per account. ## Sign-in methods You can sign in with: - **Email and password.** - **Google, GitHub, Microsoft or Atlassian**, where they're offered on the sign-in page. Link more than one, so a provider outage can't lock you out. ### Link or remove a sign-in method Go to **Account** → **Sign-in methods**. The card lists every method you can use, with its email address and when you last used it. - To add a provider, select it under **link another provider**. You're sent to the provider to approve, then back here with *Sign-in method linked.* - To remove one, select **Remove** next to it. You can't remove your only sign-in method. *Sign-in methods linked to your login.* ![Sign-in methods card listing the password sign-in, with buttons to link Google, GitHub and Microsoft](https://www.apitraffic.io/docs/images/account/sign-in-methods.png) ### Signing in with a provider for the first time When you sign in with a provider whose email address already belongs to an ApiTraffic login, the two are linked only if the provider confirms the address is verified. If it doesn't, you see *An account already uses that email address. Sign in with your existing method, then link this provider from Account settings.* Sign in the way you usually do, then link the provider from **Account** → **Sign-in methods**. If the provider shares no email address (for example, a GitHub account with no verified primary email), sign-in can't continue. Add a verified email to the provider account, or use another method. ## Your profile On **Account** → **Profile** you can change your **First name**, **Last name** and **Timezone** (an IANA name such as `America/Detroit`, used for the times the app shows you), then select **Save profile**. To change the email address you sign in with, contact support. ## Passwords A password must: - be 12 to 256 characters long, - contain a lowercase letter, an uppercase letter, a number and a symbol, - not be a single repeated character, and not contain your email address. ### Change your password 1. Go to **Account** → **Profile** and find **Password**. 2. Enter your **Current password**, then your **New password** twice. 3. Select **Change password**. Changing your password signs out every session you have, on every device, including this one. Sign in again with the new password. ### Reset a forgotten password 1. On the sign-in page, select **Forgot password?**. 2. Enter your **Email address** and select **Send reset link**. 3. Open the link in the email within 30 minutes, choose a new password, and select **Update password**. You see the same answer whether or not the address has an ApiTraffic login, so nobody can use the form to find out who has one. A reset also signs out every session you have. ## Sessions and signing out - You're signed out after 1 hour without activity, and after 12 hours in any case. - To sign out, select **Logout** at the bottom of the account sidebar, or **Log Out** in the user menu. - There's no list of active sessions to end one by one. To sign out everywhere, change your password. - When your role on an account changes, or you're removed from it, your sessions end so the change applies at once. ### Too many failed sign-ins After 10 failed sign-in attempts for the same email address, sign-in is refused with *Too many failed sign-in attempts. Please wait before trying again.* Wait 15 minutes after the last failed attempt, or reset your password. ## Two-factor authentication (MFA) A second factor means a stolen password isn't enough to sign in. ApiTraffic offers three, and you can set up all of them: | Factor | How it works | Strengths and limits | |---|---|---| | **Authenticator app** | A six-digit code from an app such as Google Authenticator, 1Password or Authy. | Works from any device and on every ApiTraffic site. | | **Passkeys** | Your fingerprint, face, screen lock or a security key. | Nothing to type. A passkey only works on the site it was created on, so you need one per ApiTraffic site you use. | | **Text message** | A six-digit code sent by SMS. | Needs no app or hardware. The least secure: a phone number can be transferred away from you by someone who convinces your carrier. | Manage all three on **Account** → **Security** (in the account sidebar under **Security & Compliance**). If you can, prefer an authenticator app or a passkey to text messages. *The Security page.* ![Security page with the Authenticator App, Passkeys, Text Message, MFA Policy and Support Access cards](https://www.apitraffic.io/docs/images/account/security-page.png) ### Backup codes When you set up your first factor, you get 10 backup codes. Each works once, in place of a code from your device. Save them somewhere safe, such as a password manager: they're shown only once. ### Set up an authenticator app **Start setup** On **Account** → **Security**, in **Authenticator App**, select **Set up authenticator app**. **Scan the QR code** On **Set Up Two-Factor Authentication**, scan the QR code with your authenticator app. If you can't scan it, copy the code under **Can't scan? Enter this code manually:** into the app. Then select **I've scanned the QR code**. *Scan the QR code with your authenticator app.* ![Set Up Two-Factor Authentication screen with a QR code, a manual setup code and the I've scanned the QR code button](https://www.apitraffic.io/docs/images/account/enroll-mfa-1-qr.png) **Confirm a code** On **Verify Setup**, enter the 6-digit code from the app and select **Verify & Enable MFA**. **Save your backup codes** On **Save Your Backup Codes**, select **Copy Codes** or **Download**, store them safely, then select **I've saved my backup codes**. *Save your backup codes before you finish.* ![Save Your Backup Codes screen listing ten one-time codes with Copy Codes and Download buttons](https://www.apitraffic.io/docs/images/account/enroll-mfa-2-backup-codes.png) You're returned to the Security page, where **Authenticator App** shows **Enabled** and the date you enrolled. To remove it, select **Remove authenticator app**, enter a current code, and select **Confirm**. ### Add a passkey **Start** On **Account** → **Security**, in **Passkeys**, select **Add a passkey**. **Name it** Give the passkey a name you'll recognize, such as `MacBook` or `YubiKey`, and select **Continue**. **Confirm on your device** Your browser asks you to confirm with your fingerprint, face, screen lock or security key. When it's done you see *Passkey added.* If this is your first factor, save the backup codes shown, then select **Copy and dismiss**. Each passkey in the list shows the site it was created for, whether it's **synced** across your devices or **this device only**, and when it was last used. A passkey made on a different ApiTraffic site is marked **Other site** and can't be used here. Use **Rename** or **Remove** to manage them. Passkeys need a current version of Chrome, Safari, Edge or Firefox. You can also choose **Use a passkey instead** on the authenticator setup screen. ### Set up text messages **Start** On **Account** → **Security**, in **Text Message**, select **Set up text messages**. **Enter your number and agree** Enter your **Mobile number, including the country code**. Read the messaging terms and tick the box to agree to receive verification codes; the box is never ticked for you. Select **Send code**. **Enter the code** Enter the six-digit code you were texted and select **Confirm**. You see *Your phone number is set up.* About the texts: - They're only ever verification codes, never marketing: one when you set the number up, then one each time you sign in. - A code is valid for 5 minutes and allows 5 tries. You can ask for another after 30 seconds (**Didn't get it? Send another**), up to 5 texts an hour. - Reply **HELP** for help. Reply **STOP** to opt out; that turns text codes off, so you'll need another factor to sign in. - Message and data rates may apply. To remove the number, select **Remove phone number**. Text messages may not be available on every installation; the card says so when they aren't. ### Signing in with MFA After your password or provider, the **Two-Factor Authentication** screen asks for a code. Depending on what you've set up, you can choose **Use a passkey**, **Use authenticator app**, **Text me a code** or **Use a backup code**. After 5 wrong codes, you see *Too many verification attempts. Please log in again.* Start again from the sign-in page. If you've lost every factor and every backup code, contact ApiTraffic support to have your MFA reset. ## Require MFA for everyone on the account The **MFA Policy** card on **Account** → **Security** has one switch, **Require MFA for all team members**. Only the account **owner** and **admins** can change it. Members see the card read-only, with the switch turned off and the notice *Only account owners and admins can change this. Ask one of them if you need it updated.* The API refuses the change for members with `403` and code `2010`. When you turn it on, you're asked to confirm with **Yes, enable enforcement**. From then on: - Everyone who hasn't set up a factor is taken to setup the next time they sign in, and can't use the account until they finish. - Nobody can remove their last remaining factor. They can remove one only while another is still set up. - The card shows the date enforcement was turned on. Turning it off takes effect at once. People can still keep or add factors voluntarily. > **Tip:** Before turning enforcement on, set up a factor yourself and tell your team, so nobody is surprised at their next sign-in. A support session can't change the policy. ## Support access The last card on the Security page, **Support Access**, lets the account owner grant ApiTraffic support temporary access to the account. See [Grant support access](https://www.apitraffic.io/docs/account/support-access). ## Activity Security changes appear in the [account history](https://www.apitraffic.io/docs/account/activity-log) under **Security**: sign-ins and sign-outs, password changes, MFA turned on or off, passkeys and phone numbers added or removed, and changes to the MFA requirement. ## Troubleshooting **Too many failed sign-in attempts. Please wait before trying again.** Wait 15 minutes after the last failed attempt and try again, or reset your password. **MFA cannot be disabled because your account administrator requires it.** The account requires MFA and this is your last factor. Set up another factor first, then remove this one. **I can't change Require MFA for all team members** Only the account owner and admins can change the MFA policy. Ask one of them to turn it on or off. **Passkey setup was cancelled or timed out.** The browser prompt was closed or not answered in time. Select **Add a passkey** and try again. **A passkey is marked Other site** Passkeys only work on the site they were created on. Add a separate passkey here, or sign in on the site the passkey belongs to. **Too many codes have been sent to this number. Please try again later.** You've reached the hourly limit for texts. Wait, or use another factor or a backup code. **The reset link has expired** Reset links work for 30 minutes and once. Select **Request a new reset link** and use the newest email. ## Related - [Team and roles](https://www.apitraffic.io/docs/account/team): Who can change what on the account. - [Grant support access](https://www.apitraffic.io/docs/account/support-access): Let ApiTraffic support help, for a limited time. - [Account history](https://www.apitraffic.io/docs/account/activity-log): Review sign-ins and security changes. - [API tokens](https://www.apitraffic.io/docs/account/api-tokens): Credentials for SDKs, scripts and AI assistants.