> ## Documentation Index
> Fetch the complete documentation index at: https://docs.terminus.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Require two-factor authentication for everyone in your account, see what members experience when it is on, and know who is exempt.

<Info>
  The **Security** page has two settings. This page covers **Require two-factor authentication**: with it on, every member must set up an authenticator app before they can use the account. The other, **Allow members to connect apps**, controls whether members can connect AI apps like Claude or ChatGPT; turning it off disconnects every connected app in the account right away (see [Connect AI apps](/guides/connect-ai-apps)). Account owners and admins can change both. In the account menu, choose **Settings**, then **Security**.
</Info>

## Require two-factor authentication

<Steps>
  <Step title="Open Security">
    In the account menu, choose **Settings**, then **Security**.
  </Step>

  <Step title="Turn on the setting">
    Switch on **Require two-factor authentication**. A confirmation explains that members who have not set up two-factor authentication will have to set it up the next time they sign in. If you have not set it up yourself, it also tells you that you will be asked to right away.
  </Step>

  <Step title="Confirm">
    Click **Require**. The setting applies immediately.
  </Step>
</Steps>

Turning the setting off applies immediately, with no confirmation. Members who already set up two-factor authentication keep it; turning it off only stops requiring it.

## What members see

While the setting is on, anyone in the account without two-factor authentication, owners and admins included, is taken to a setup screen the next time they open the account: "Your account admin requires two-factor authentication for" your account. The screen walks them through the same steps as setting it up from their profile:

1. Confirm their password (skipped when they signed in through SSO).
2. Scan the QR code with an authenticator app and enter the code it shows.
3. Save their backup codes, tick **I saved these codes**, and click **Done**.

From the setup screen they can also **Switch account** (to an account that does not require it) or **Sign out**. Members who already use two-factor authentication notice nothing new.

To set it up ahead of time, a member can follow [Profile settings](/account/profile#two-factor-authentication).

## Who is exempt

* **SSO sign-ins.** A member who signed in through this account's [single sign-on](/account/sso) connection is not asked to set up two-factor authentication, because your identity provider handles it. Signing in through another account's SSO does not count.
* **API keys.** Requests made with an [API key](/account/api-keys) are not affected.

## If a member loses their authenticator

A member can sign in with one of their backup codes. If they have none left, an owner or admin can reset their two-factor authentication from **Members**. See [Reset a member's two-factor authentication](/account/team-members#reset-two-factor-authentication).

## Related

<CardGroup cols={2}>
  <Card title="Profile settings" icon="user" href="/account/profile">
    Turn two-factor authentication on or off for yourself.
  </Card>

  <Card title="Team members" icon="users" href="/account/team-members">
    See who has two-factor authentication and reset it for a member.
  </Card>

  <Card title="Authentication" icon="key" href="/authentication">
    Signing in with a code or a backup code.
  </Card>

  <Card title="Single sign-on" icon="shield-check" href="/account/sso">
    Connect your identity provider.
  </Card>
</CardGroup>