Two-factor authentication (2FA) adds a second layer of protection to your account. When you sign in, your password alone is no longer enough – you also enter a short code from an app on your phone. Even if someone knows your password, they can't get in without your device.
You'll find the setting in your account under Security.
Open in the app: Security & 2FA Set up two-factor authentication, manage recovery codes · login requiredWhat you need
An authenticator app on your smartphone. Common free apps include Google Authenticator, Microsoft Authenticator, Authy, or the password manager 1Password. Any of them works – just pick one.
Setting it up
- In your account, go to Security and click Set up two-factor.
- A QR code appears. Open your authenticator app and scan it. If scanning doesn't work, you can also type in the key shown underneath by hand.
- Your app now shows a six-digit code that changes every 30 seconds. Enter the current code in the confirmation field and click Activate.
Once the code is correct, 2FA is active – and you'll see your recovery codes once.
Keep your recovery codes safe
Recovery codes are your backup key for when you don't have access to your authenticator app – for example because your phone is lost or new. Each code works exactly once.
- Store them somewhere safe, separate from your password (e.g. in a password manager or printed out).
- They are shown only once. Use the Copy codes button to save them right away.
- You can generate a fresh set anytime under Security – your old codes stop working when you do.
Signing in with 2FA
After you enter your email and password, maebe asks for your code. Open your authenticator app, enter the current six-digit code – done.
This also applies when you sign in with Google or Apple: if you have 2FA enabled, you'll be asked for your code after clicking the provider login.
Don't have your phone handy? On the sign-in page, choose Use a recovery code instead and enter one of your recovery codes.
Lost your authenticator?
No problem, as long as you still have a recovery code: sign in with it, go to Security, turn off the old 2FA, and set it up fresh with your new app.
If you have access to neither the app nor your recovery codes, contact support – we'll help you get back in.
Why 2FA may be required for you
If you work in a team that uses Social Connect (publishing directly to connected social media accounts), 2FA becomes mandatory for you. Here's why: such an account can post directly to your clients' real channels – something we want to protect especially well.
You get one week to set it up. During that time, a reminder nudges you to enable 2FA. After that, your access stays, but to edit content you'll need 2FA turned on. You can of course always sign in, manage your account, and set up 2FA.
Turning it off again
You can disable 2FA anytime under Security. To confirm, you enter a current code from your app or a recovery code – no password required, so it works even if you only sign in with Google or Apple. After that, your account is protected by password or provider login only. (In teams with Social Connect, the requirement kicks in again after a short while.)
You confirm regenerating your recovery codes the same way – with a current code from your app or a recovery code.