Two-factor authentication for the dashboard
The dashboard now supports two-factor authentication. In Account › Security you can add an authenticator app (TOTP), passkeys or security keys, and you get 10 single-use recovery codes. You can also sign in with a passkey alone, and remember a trusted browser for 30 days. Sensitive actions, such as creating an API token, changing a member's role or deleting a domain, ask you to confirm it's you if you have not done so in the last 10 minutes.
Owners and admins can require 2FA from every member of an organization, and Members shows who has it on. Granting an MCP client access through OAuth now needs a session that passed 2FA. API tokens keep working as before.
See Account security.