Two-factor authentication

Two-factor authentication adds a second step when you sign in. After your password, Plank asks for a six-digit code from an app on your phone. Someone who learns your password still can't get in without the phone.

It's optional, and you turn it on per account in Settings → Security.

What you need first

An authenticator app on your phone. If you don't have one, install any of these — they all work the same way:

• 1Password or Bitwarden, if you already use a password manager
• Google Authenticator
• Authy

You only need one. Install it before you start, because the setup screen asks you to scan a code with it.

Turning it on

1. Go to Settings → Security and click Turn on two-factor authentication.
2. Plank shows a square QR code. Open your authenticator app, choose to add an account, and point your phone's camera at it. If your phone won't scan it, the app can also take the setup key printed underneath — type it in by hand instead.
3. Your authenticator app starts showing a six-digit code that changes every 30 seconds. Type the current one into Plank and click Confirm and turn on.

Turning this on signs you out everywhere else, including the Plank mobile app and any other browser. That's deliberate — it makes sure every signed-in device goes through the new check. Sign back in with your password and a code.

Save your recovery codes

Right after you turn it on, Plank shows ten recovery codes. Each one works a single time, and they're the way back into your account if your phone is lost, broken, or wiped.

They're shown once. Plank keeps only a scrambled version and cannot show them to you again.

Copy them somewhere you can reach without your phone:

• a password manager, or
• printed on paper, somewhere you'd find it

Saving them to a note on the phone that has your authenticator app defeats the point — if you lose the phone, you lose both.

You can generate a fresh set at any time from Settings → Security. Doing that immediately stops the old ten from working.

Signing in from then on

Password first, then a screen asking for the six-digit code. Your phone may offer to fill it in for you.

If codes keep getting rejected, check that your phone's clock is set to update automatically. Authenticator codes are generated from the current time, so a phone whose clock has drifted produces codes Plank reads as wrong.

If you lose your phone

On the code screen, choose Use a recovery code instead and enter one of the ten you saved.

That switches two-factor authentication off and signs you in. Set it up again from Settings → Security with your new phone — you'll get a fresh QR code and a fresh set of recovery codes.

You get five tries every fifteen minutes, so take a moment to find the right code rather than guessing.

If you've lost your phone and your recovery codes

There's no self-serve way back in. Contact support and we'll verify who you are before turning two-factor authentication off for your account.

This is the situation the recovery codes exist to prevent, which is why it's worth putting them somewhere durable the day you turn 2FA on.

API keys keep working

If you use API keys (Settings → API keys) for scripts, integrations, or a coding assistant, those keep working without a code. That's what makes them usable from a script in the first place.

Creating a new key requires you to have completed the two-factor step. Keys you made earlier keep working, so if you have old ones you no longer recognise, review and revoke them from Settings → API keys.

Turning it off

Settings → Security → Turn off two-factor authentication. Plank asks you to confirm, because afterwards your password is the only thing protecting the account, and your recovery codes stop working.