# Two-factor authentication for the dashboard

> Protect dashboard sign-in with an authenticator app, passkeys or security keys and recovery codes, and require 2FA in your organization.

The dashboard now supports two-factor authentication. In **Account › Security** you can add an authenticator app (TOTP), passkeys or security keys, and you get 10 single-use recovery codes. You can also sign in with a passkey alone, and remember a trusted browser for 30 days. Sensitive actions, such as creating an API token, changing a member's role or deleting a domain, ask you to confirm it's you if you have not done so in the last 10 minutes.

Owners and admins can require 2FA from every member of an organization, and **Members** shows who has it on. Granting an MCP client access through OAuth now needs a session that passed 2FA. API tokens keep working as before.

See [Account security](https://developers.openwaf.dev/fundamentals/account-security/).