Set up two-factor authentication

Two-factor authentication adds a verification step to your Brightstone sign-in. A workspace can require stronger verification for privileged accounts, so your available choices may depend on its policy.

Add an authenticator

1. Open Account and find Two-factor authentication.
2. Select Set up authenticator.
3. Complete any requested verification of your existing sign-in or account email.
4. Follow the setup screen in a supported TOTP authenticator app.
5. Enter the current code to confirm setup.
6. Save the recovery codes securely, apart from the device holding your authenticator.

Do not send an authenticator secret, recovery code or emailed verification code to support, an advertising provider or an AI assistant.

Recovery codes

A recovery code is a backup sign-in method. Each code is usable once. New recovery codes replaces the previous set, so store the new set and stop using the old one.

An enrolled passkey or other supported enabled verification method may also be offered. The methods available on a verification screen depend on what you have actually enrolled.

Trust a device

After verification, Brightstone may offer Trust for 30 days. Choose it only on a device you control. Trust can expire or be revoked, and unusual sign-in signals can still require fresh verification.

Signing out ends the session; it does not automatically mean the device should remain trusted forever. Clearing browser cookies or using another browser removes that browser's proof.

If a code fails

Use the current code, check the device's time and ensure you selected the intended method. An emailed code must be entered in the browser where it was requested. If access cannot be recovered, use the verified support route; support cannot safely ask you to disclose your codes.