Both controls live in one place: Settings, Account.
Turn on two-factor authentication
Two-factor authentication is optional and strongly recommended. There is one kind of second factor: a code from an authenticator app (Google Authenticator, 1Password, Aegis, or any standard TOTP app).
- Open Settings, Account and find Two-factor authentication.
- Hit Add authenticator app. A QR code and a setup key appear.
- Scan the QR with your app, or type the setup key in by hand if you cannot scan.
- Enter the six-digit code your app shows, then Turn on 2FA.
Nothing is live until that code verifies, so an abandoned setup leaves nothing behind. You can add more than one app, and remove any of them from the same list.
What changes at sign-in
Your password does not change. After signing in you land on a Verify it's you screen and enter the current code from your app. That gate sits on the dashboard itself, so it applies however you signed in: password, Google, or a magic link. The API behind the app enforces the same rule, so a session that skipped the challenge cannot act through it either.
If you lose your authenticator
There are no printed backup codes today, so the safety net is something you set up in advance:
- Add a second authenticator app on another device.
- Keep the setup key from step 2 somewhere safe. It is what recreates the same codes in a new app.
Already locked out? Contact support: they can remove the lost factor, which signs you out of every active session, and you set 2FA up again from scratch.
CLI sessions
The same tab lists every device connected with promptdock login, with when it was added, last used, and expires. Revoke ends one immediately.
Generate token mints a token for CI instead. Name it, copy it once (it is shown a single time and kept only as a hash), and set it as PROMPTDOCK_TOKEN in your pipeline. Tokens start with pdk_, and each one's expiry slides forward another 90 days every time the CLI uses it, under a ceiling that never moves. The rest of the command set is in the CLI docs.