**Source:** https://heykiku.com/help/setting-up-2fa

# Set Up Two-Factor Authentication

Two-factor authentication adds a one-time code to your sign-in. Even if someone has your password, they can't get into your workspace without your authenticator app.

## When You Need It

Workspace owners and admins who manage billing must enable two-factor authentication before they can change a plan, update payment details, or cancel a subscription. Anyone else on your team can opt in voluntarily — kiku will keep working either way.

## What You'll Need

- An authenticator app on your phone (1Password, Authy, Google Authenticator, or any TOTP app)
- A safe place to store your recovery codes (a password manager works well)

## Step-by-Step

1. Sign in and open **Settings** → **Security** → **Two-factor authentication**.
2. Click **Set up two-factor authentication**.
3. Open your authenticator app and scan the QR code on screen. If you can't scan, tap **Show secret key** and type the 32-character key into your app instead.
4. Your authenticator now shows a 6-digit code that changes every 30 seconds. Type the current code into kiku and click **Verify**.
5. kiku shows you 8 recovery codes. **Save them now** — you'll only see them once. Each code works for one sign-in attempt if you lose your phone.

That's it. Next time you sign in, you'll enter your password and then a code from the app.

## Tips

- Recovery codes are case-insensitive and you can leave the dashes in or take them out.
- If you switch authenticator apps later, disable 2FA in kiku first and then re-enroll with the new app — keys can't be moved between apps.
- Your recovery codes can be regenerated at any time from the same settings page. Doing so invalidates the old set.

## What Doesn't Work

- SMS codes — heykiku only supports authenticator apps, which are harder to phish.
- Sharing one authenticator across multiple people — the code is tied to your account.

If you ever lose your phone, see [lost your authenticator app?](https://heykiku.com/help/lost-authenticator).