Click your profile avatar → Profile → Authentication. The two-factor card shows your current status.
2
Add an authenticator app
Click Set up authenticator app, scan the QR code (or enter the secret manually), and confirm with a code. On confirmation you receive your recovery codes - store them somewhere safe; each works once.
3
Add a passkey (optional but recommended)
Click Add passkey and follow your browser’s prompt. You can register multiple passkeys and security keys and remove them individually.
You cannot remove your last remaining factor while 2FA is active - add a replacement first.
After your password (or SSO), Ankra prompts for a second factor. Use a passkey with one tap, enter a TOTP code, or switch to Use a recovery code instead. Repeated failed attempts invalidate the pending login and you’ll need to start over.
Organisations can require 2FA for all members. If any of your organisations enforces it and you haven’t enrolled, Ankra shows a Secure your account to continue screen at sign-in and blocks the platform until you complete enrollment.
The CLI hands 2FA management to the browser, because TOTP enrollment, recovery codes and passkey registration (WebAuthn) all need one:
ankra profile auth open # open this account-security page in your browser
CLI logins that hit an MFA challenge complete in the browser and hand control back to the terminal automatically. Full command details are in the CLI reference.
