Sign in with an authenticator app
RepoOps asks for a 6-digit code from an authenticator app on every new sign-in, and again before a high-risk change. This page shows how to set one up, what to do when you lose your phone, and what a team owner and RepoOps staff can reset.
Watch it
Transcript
The walkthrough is silent. These are its captions, in order. Every value it shows is illustrative.
- 0:00Scan the QR code, then enter the code the app shows
- 0:06Ten recovery codes, shown once. Each signs you in once.
- 0:12Every new sign-in asks for the current code
- 0:18High-risk changes ask for a fresh code. Recovery codes do not count.
- 0:24Lost the phone and the codes? A team owner resets it with their own code.
The names, codes and dates in this video are illustrative.
How to
An authenticator app on your phone, such as 1Password, Google Authenticator or Authy.
A recent sign-in. Setting up a first authenticator needs a sign-in from the last ten minutes; if the setup page says so, sign out and back in.
- Open the setup page.
Press Set it up on the banner that every hosted page shows while your account has no authenticator, or open Settings, Security, or go to
/account/two-factor. The page reads Add an authenticator app and draws a QR code with the setup key under it, for typing in by hand. - Scan the code and turn it on.
Scan the QR code with your app, type the 6-digit code it shows into Code from the app and press Turn on. A wrong code saves nothing and counts as one try.
- Save your recovery codes.
The next screen, Save your recovery codes, shows ten codes like
7KQ2-MX9PTA, once. RepoOps keeps only a hash of each. Press Copy or Download .txt, put them somewhere apart from your phone, tick I saved these somewhere safe, and press Continue. - Sign in with a code.
From then on, every new sign-in opens Enter your code. Type the current code from the app and press Verify. Only that browser counts as verified: a second browser, or a sign-in tomorrow, asks again. There is no option to remember a browser.
- Manage it in Settings, Security.
On the Team settings page, Security shows when the authenticator was turned on and how many recovery codes are left. Replace moves you to a new app and needs a code from the current app or a recovery code; the old app works until the new one is on. Make new codes needs a code from the app and replaces all ten. Sign out others ends every other browser session. Review lists your CLI and personal tokens with a Revoke button each. There is no switch that turns the authenticator off.
Use cases
An admin changes a teammate's role
- Situation
- You are signed in and verified, and you want to make a member an admin on the Overview tab of Team settings.
- You do
- Pick the role, type the current code from your app into the code field beside the form, and save. The code you signed in with a moment ago does not count twice; wait for the next one.
- You see
- The role changes and Activity records it. Someone who took over your browser session cannot make the change without your phone.
A member loses their phone and their codes
- Situation
- Ana, a member of your team, has a new phone and cannot find her recovery codes, so she cannot sign in.
- You do
- Check it is really Ana, outside RepoOps. Then, as a team owner, open her row in Settings, Members, choose Reset authenticator and confirm with a code from your own app.
- You see
- Ana is signed out everywhere, her CLI and personal read tokens stop working, and she gets an email. At her next sign-in she sets up the new phone. Her machines keep capturing all the while.
Expected outcome
Next step: Check that the app entry reads RepoOps and that your phone's clock is set automatically, then enter the current code.
Next step: Each code works once, for one sign-in or one change. Wait for the next code in your app.
Next step: Five wrong codes in ten minutes lock code entry for ten minutes, and each further lock that day lasts twice as long, up to a day. On the sign-in page a recovery code still works while locked. RepoOps emails you when entry locks, in case it was not you.
Next step: Your account has no authenticator, and high-risk changes need a code from one. Follow the setup link, then make the change again.
Next step: A first setup needs a sign-in from the last ten minutes. Sign out, sign back in, and open the setup page straight away.
Next step: A member asks a team owner to reset the authenticator. A team owner or a solo account contacts support; staff reset it after checking who you are.
What else to consider
Who is asked, and from when
An account that has an authenticator is asked for a code on every new session now. From 12 November 2026, an account with none is sent to the setup page at sign-in and cannot use RepoOps until it adds one; until then it sees the banner. Per-team SSO (OIDC or SAML) counts as the second factor, because the identity provider checks it, but only for an account with no RepoOps authenticator and only while the team has not turned on Also require a RepoOps authenticator on the Single sign-on page. Signing in with Google, Apple, GitHub, Microsoft Entra ID, Okta or an email link is not per-team SSO, so it asks for the code like any other sign-in.
Changes that ask for a code
These changes ask for a current code from the app even in a verified session: inviting a member, changing a role and removing a member; revoking a device; repository fidelity; retention and retention holds; repository scope; the policy bundle; the redaction policy; repository controls; decisions on held calls; budgets; and turning production evidence on. Making a personal read token, replacing the authenticator, making new recovery codes and resetting someone else's authenticator ask too.
A recovery code is never accepted for a change, only for signing in. Each code is spent on use, so the code that signed you in cannot also confirm a change. An account with no authenticator is refused these changes with Add an authenticator to make this change and a link to the setup page, on any date.
Resets
A team owner resets a member from Settings, Members with a code from the owner's own app; a recovery code does not do. The reset removes the member's authenticator and recovery codes, ends every session they have, revokes their CLI and personal read tokens, emails them, and records two_factor.reset in Activity with the owner's name. Desktop machines stay bound and keep capturing. An owner cannot reset another owner: the page points to support. Team owners and solo accounts are reset by RepoOps staff, who check identity outside the product first, with the same effects and an Activity row that says staff did it. There is no reset by email, because a read mailbox must not be enough to take an account.
Emails and the low codes banner
RepoOps emails you when an authenticator is turned on, when it is replaced, when code entry locks, and when an owner or staff resets it, so a change you did not make does not go unseen. When fewer than three recovery codes are left, a banner asks you to make new ones in Settings, Security.
Tokens
A CLI token from repoops login, a personal read token and a desktop connect code can only be made from a verified session, and a personal read token also needs a current code. Settings, Security lists your CLI and personal tokens with when and how each was made. A CLI token made before RepoOps kept each token's id cannot be revoked on its own: it is listed as such and stops working when it expires, 90 days after it was made. Sign out others does not touch tokens; revoke them one by one.
What RepoOps stores
The authenticator's secret is sealed with AES-256-GCM under a key used for nothing else, bound to your account, so a copied row does not open for another account. Recovery codes are stored only as keyed hashes. Codes are checked on the server, each try is counted before the compare, and nothing about the authenticator leaves repoops.ai.