Two-Factor Authentication
Secure your account with two-factor authentication (2FA)
Two-factor authentication (2FA) adds an extra layer of security to your Integrity account. When enabled, you'll need both your sign-in credentials (email/password or OAuth provider) and a verification code from your authenticator app to access your account.
Two-factor authentication is required for all Integrity accounts to protect sensitive safety data.
Passkeys and 2FA
Passkeys, such as Touch ID, Windows Hello, device PINs, and hardware security keys, are supported as a faster way to complete the first sign-in step when passkeys are enabled for the environment.
They do not replace required 2FA in Integrity. After any successful sign-in method, including a passkey, Integrity checks your account and session state:
| State | What happens |
|---|---|
| No verified authenticator app | You are sent to 2FA setup before workspace access |
| Verified authenticator app, current session not 2FA-verified | You are sent to the 2FA challenge |
| Current session is 2FA-verified | You continue to your destination |
Treat passkeys as faster sign-in, not as an option to skip authenticator-app 2FA. The 2FA requirement stays the same for password, OAuth, SSO, and passkey sign-in.
Setting Up 2FA
When you first sign in to Integrity (or if you haven't set up 2FA yet), you'll be automatically redirected to the 2FA setup page. You must complete this setup before accessing any workspace.
Install an authenticator app
Download one of these apps on your phone:
Scan the QR code
- Click Enable Two-Factor Authentication
- Open your authenticator app and scan the QR code
- If you can't scan, click "Can't scan?" to see the manual entry code
Verify setup
Enter the 6-digit code from your authenticator app to confirm setup.
Save your recovery codes
You'll receive 10 recovery codes. These are one-time backup codes in case you lose access to your authenticator app.
Save these codes securely! Store them in a password manager or print them and keep them safe. Each code can only be used once.
- Click Copy all to copy codes to clipboard
- Click Download to save as a text file
- Check the confirmation box after saving
After 2FA setup completes, other active sessions for your account must reauthenticate before they can open protected app data again.
Signing In with 2FA
After signing in with your credentials (email/password, Google, or GitHub), you'll be asked for a verification code:
- Open your authenticator app
- Find the entry for "Integrity"
- Enter the 6-digit code (codes refresh every 30 seconds)
Using Recovery Codes
If you don't have access to your authenticator app (lost phone, new device, etc.):
- On the verification screen, click Use recovery code
- Enter one of your 16-character recovery codes (format:
XXXX-XXXX-XXXX-XXXX) - Your 2FA will be reset and you'll be redirected to set up a new authenticator
- After setting up your new authenticator, you'll receive new recovery codes
Using a recovery code resets your 2FA completely. This ensures you always have a working authenticator and fresh recovery codes after regaining access. Other active sessions must reauthenticate after the reset.
Regenerating recovery codes is also treated as a security-sensitive change. Other active sessions must reauthenticate after new recovery codes are created.
Recovery-code attempts are rate limited. If too many attempts happen in a short period, Integrity pauses verification briefly and shows retry timing without revealing whether a specific code was close or valid.
Lost Access?
| Scenario | Solution |
|---|---|
| Lost phone, have recovery codes | Use a recovery code — your 2FA will reset and you'll set up a new authenticator |
| Lost phone, no recovery codes | Contact admin@irsiks.com for identity verification and manual reset |
| Forgot password + lost phone, have recovery codes | Use "Forgot Password?" to get email link, then use a recovery code on the password reset page |
| Forgot password + lost phone + no recovery codes | Contact admin@irsiks.com — after identity verification, admin will reset your 2FA, then you can reset your password |
| Lost access to login email (any reason) | First, create a new account with your new email using email/password signup (not OAuth). Then contact admin@irsiks.com — after identity verification, admin will transfer your account. You'll then reset your password via the "Forgot Password?" flow. |
| New phone, old phone available | Add Integrity to your new phone's authenticator app using the same TOTP secret, or use a recovery code to reset |
| Need to change authenticator | Use a recovery code to reset, or contact admin@irsiks.com |