FeatureReleased 8 Aug 2026
Multi-factor authentication
Multi-factor authentication is now available for dashboard accounts, adding a second step at login on top of the password, from an authenticator app (TOTP), SMS, or a passkey. Passkeys can also replace the password entirely for passwordless sign-in.
What changed
Added
- Multi-factor authentication for dashboard sign-in, with a choice of factors: a TOTP authenticator app, SMS one-time codes, or a passkey.
- Passwordless login with a passkey.
- Per-provider policy: a provider can encourage MFA (prompt users to set it up) or enforce it (require it to sign in), and can always enforce it for administrators regardless of the provider setting.
- Self-service account recovery with recovery codes, for a user who loses a factor.
- Security notification emails, such as an alert when a new device signs in.
- A security view showing recent sessions and logins: device, location, time and method, so unusual access is easy to spot.
- Optional email verification at login for accounts that need an extra check.