> ## Documentation Index > Fetch the complete documentation index at: https://docs.clinikapi.com/llms.txt > Use this file to discover all available pages before exploring further. # Security > Turn on two-factor sign-in with an authenticator app, and remove one if you lose the phone. # Security ## What this is for Passwords get guessed, reused and leaked. Two-factor sign-in adds a second step: after your password, the dashboard asks for a 6-digit code that changes every 30 seconds and is generated by an app on your phone. Someone who steals your password still cannot get in without your phone. The **Security** page is where you turn this on, add a second phone or app, and remove one. ## Before you start * You need an **authenticator app** on your phone. Any standard one works, for example Google Authenticator, Microsoft Authenticator, 1Password or Authy. If you have none, install one first. * Every role can do this. It protects your own account only. * Keep your phone nearby; you will scan a code and read a code from it. ## Turn on two-factor sign-in **1. Open Security** Select your initial (top right) to open the account menu, then **Security**. The page is titled **Security** with the line "Protect your account with a second step at sign-in." **2. Start the setup** In the **Two-factor authentication** card, select **Set up an authenticator app**. A panel titled **Set up an authenticator app** opens. **3. Scan the QR code** In your authenticator app, choose to add an account and scan the square code on screen. If you cannot scan (for example you are on the same phone), select the copy button next to **Can't scan? Enter this key in the app** and paste that key into the app by hand. **4. Enter the 6-digit code** The app now shows a 6-digit number. Type it into **6-digit code**. Only digits are accepted. **5. Confirm** Select **Verify and turn on**. A message says **Two-factor authentication is on** and the badge at the top right of the card changes from **Off** to **On**. If you close the panel with **Cancel** before confirming, nothing is turned on and the half-finished setup is discarded. ## What you'll see * The **Two-factor authentication** card with a badge: **Checking…** while it loads, then **Off** or **On**. Its button reads **Set up an authenticator app**, or **Add another authenticator** once you have one. * A card titled **Your authenticators** listing each app, its name (shown as "Authenticator app" or the name it was given), when it was **Added**, and a **Remove** button. Until you add one it reads **None yet.** * A card titled **Unfinished setups** appears only if you started a setup and never confirmed it. These protect nothing. Remove them to keep things tidy. * A note that your sign-in is shared with ClinikEHR (the same account), so an authenticator you add here also asks for its code when you sign in there. ## Remove an authenticator Select **Remove** beside it. A confirmation titled **Remove authenticator** says "You will no longer be asked for a code from this authenticator when you sign in." Select **Remove** again to confirm. A message says **Authenticator removed**. ## Check that it works Sign out from the account menu, then sign in again. After your password you should be asked for a code before the console opens. Add a second authenticator (a different phone) as a spare so losing one phone does not lock you out. ## Common questions > **What is an authenticator app?** > > A free app that creates a new 6-digit code every 30 seconds from a secret it shares with the dashboard. It works offline, so you do not need signal to read the code. > **Do I have to turn this on?** > > It is optional and personal. Requiring it for every member of an organization is not available yet. > **I got a new phone. What now?** > > If your old phone still works, add the new one with **Add another authenticator**, then remove the old one. If the old phone is gone, you may not be able to remove it yourself (see Troubleshooting); contact support from the help menu. > **Why is there an Unfinished setups list?** > > Each time you start a setup, an entry is created. If you leave before confirming, it can stay behind. It is harmless, and you can remove it. > **Does this also affect ClinikEHR?** > > Yes, if you use it. It is the same sign-in, so an authenticator you add here is asked for there too. ## Troubleshooting | What you see | What to do | | - | - | | **Could not start setup** — "Please try again." | The setup could not begin. Wait a moment and select **Set up an authenticator app** again. | | **Could not check the code. Please try again.** | The check could not run, which is not the same as a wrong code. Retry. | | **That code is not right. Check the app and try again.** | The code is wrong or expired. Wait for the next code to appear and type it right away. Check that your phone's clock is set automatically. | | **Could not remove it** — "You may need to confirm a code from this authenticator first." | Removing an active authenticator needs a recent code check. Sign out and back in (entering a code), then try again. If you no longer have the device, contact support. | | The **Verify and turn on** button is greyed out | It enables when exactly six digits are entered. | ## Related * [Profile](https://docs.clinikapi.com/dashboard/account-access/profile.md) * [Members](https://docs.clinikapi.com/dashboard/organizations/members.md) * [Glossary: two-factor](https://docs.clinikapi.com/dashboard/glossary.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.