Turn on two-factor authentication

Ask for a code from an authenticator app, such as Google Authenticator or 1Password, each time you sign in. It takes about 3 minutes. Zof never sends codes by text message.

Turn it on

1. Open Settings › Account security and click Set up two-factor.
2. Scan the QR code with your app, or type in the key shown next to it. On a phone, use Copy key or Open in authenticator app.
3. Enter the 6-digit code from the app and click Turn on.
4. Save your 10 backup codes with Copy or Download. They are shown only once.

Check that it worked

Settings › Account security says "Two-factor authentication is enabled". At your next sign-in, after your usual sign-in step (such as the email link or code), Zof asks for the 6-digit code from your app. Lost your phone? Choose Use a backup code and enter one of yours. Each backup code works once.

After 5 wrong codes in a row, two-factor locks for 15 minutes. New backup codes and Turn off each need a code. Changes and lockouts are recorded in the audit log: Admin › Audit and data › Audit log.

For admins: company sign-in rules

Turn on your own two-factor first. In Admin › Auth & SSO, click Edit on Two-factor authentication and turn on Require two-factor for all members. Members without it must set it up before they can reach anything else, and nobody can turn theirs off.

The MFA column in Admin › Users shows "On", "Off" or "Required, not set up". For a member who lost their phone and backup codes, open them and click Reset. You can't reset your own.

Click Edit on Sign-in methods and tick the methods members may use, such as Email link or code or Single sign-on (SSO), then click Save sign-in methods. Anyone signed in another way is signed out at their next click, and a new sign-in that way is refused. The Audit log shows "Sign-in methods set to" and the methods you kept. When SSO is ticked but not working, the Sign-in methods row says why, such as "Single sign-on (SSO) isn't set up yet."

Zof refuses to save with no method ticked, or when no admin of your company could still sign in: at least one admin must have a kept method set up, such as a verified email address. SSO doesn't count, so admins always keep another way in. A method Zof hasn't set up yet, such as Google, shows "Not available yet" and can't be ticked until it is. If your company already had it on, it says "On for your company, but not available yet" and Zof keeps that setting; nobody can sign in with it until it is set up. A member of more than one company must use a method each of their companies allows, so Zof also refuses a change that would leave another company without an admin who can sign in. Removing a method signs members' CLI tokens out; they sign in again from the CLI.

Click Edit on Session policy, choose an Idle timeout and a Maximum session length, then click Save session policy. Each can be shorter or longer than the Zof default, marked (default), up to Zof's maximum. Longer limits are less secure. The idle timeout can't be longer than the maximum session length. A member of more than one company gets the shortest limit. Sign out everyone signs out every member except you, after you confirm. CLI tokens older than the Maximum session length stop working too. Each member can pick a shorter Session timeout for themselves in Settings › Account security, never a longer one. Every change is in the Audit log.

Click Edit on IP allowlist, choose Whole app or Admin areas only, list the Allowed ranges one per line (such as 203.0.113.0/24), and click Save IP allowlist. If the list leaves out the IP you're on, Zof says so and saves only after Save anyway; if it leaves out every admin's last-seen IP too, a second confirmation, "This will lock out all admins", is needed. Requests from anywhere else are refused until you change it, from the browser and from CLI tokens alike. With Admin areas only, an admin outside the list can still work as a member but can't use admin pages or admin actions. Someone refused this way sees a page that says their network isn't on the allowlist and what to do, not the sign-in page: signing in again doesn't change the network.

Click Set up or Edit on Single sign-on (SAML). At the top, under For your IdP, Zof shows the ACS URL for your IdP, the Entity ID (audience) for your IdP and the Metadata URL, each with a copy button, before anything is saved. Add them to your IdP's SAML app first: Okta calls them Single sign-on URL and Audience URI, Entra calls them Reply URL and Identifier. Saving or editing the connection keeps these values; the metadata URL works once the connection is saved. After Remove connection, check that your IdP still has the values Zof shows before you set it up again. Add domain for each email domain, publish the TXT record Zof shows (it expires after 7 days), and click Verify. Then enter the IdP sign-in URL, IdP entity ID and IdP signing certificate from your IdP and click Save connection. Zof accepts only signed responses, and only for addresses on your verified domains. Add new SSO users as viewers lets new people in as viewers; Require SSO for verified-domain users makes members on those domains use SSO, while admins keep another way in. Members sign in with Sign in with SSO on the sign-in page. Remove on a domain and Remove connection ask you to confirm first: SSO stops for that domain, and removing the connection also turns Require SSO off.