Turn on two-factor authentication and manage your sessions

Your SrvYard account can reach every server in your organisation, so a stolen password would be a stolen fleet. Two-factor authentication adds a second proof at sign-in: a six-digit code from an app on your phone. Passkeys go further and replace the password with a key stored on your device.

This article covers the Security page of your account: confirming your password, turning on two-factor and keeping your recovery codes, adding a passkey, finding and ending sessions, reading the sign-in history, and, for owners, requiring two-factor from every member of an organisation.

Before you begin#

• An authenticator app on your phone, such as the one built into your password manager. Any app that supports time-based one-time codes (TOTP) works.
• A password manager or a safe place for the recovery codes you will receive.
• Your current password. The Security page asks for it first, because it holds sensitive settings.
• A verified email address. The Security page is part of the signed-in settings that need a verified account. See Create your account, verify your email and set up two-factor.

1. Open Security and confirm your password#

Open your account settings from the avatar menu and choose Security. The page first shows a card titled Confirm your password: "This is a secure area. Confirm your password to manage two-factor authentication and passkeys." Type your password and press Confirm password. The confirmation is remembered for three hours, then asked again. An account that signed up with a social login and has no password sees a card to verify with that provider instead.

Then the page opens.

1. Update password. At the top left: Current password, New password, Confirm password and Save. Use a long random password from a password manager.
2. Enable 2FA. Under Two-factor authentication. This is step 2.
3. Add passkey. Under Passkeys, for passwordless sign-in. This is step 3.
4. Sign out other sessions. Above the list of Login sessions. This is step 4.

Beside the passkeys is Connected accounts: GitHub, Google, GitLab and Apple can be connected as extra ways to sign in. You can disconnect a provider only while you still have another way in, so an account that has no password must create one first.

2. Turn on two-factor authentication#

Press Enable 2FA. A window titled Enable two-factor authentication opens.

1. Scan the QR code with your authenticator app, or copy the setup key shown under "or, enter the code manually" into the app.
2. Press Continue. The window title changes to Verify authentication code.
3. Type the six-digit code that the app shows now.
4. The title changes to Two-factor authentication enabled. Press Close.

SrvYard turns two-factor on only after you have proved the app works, so a typo in the setup cannot lock you out. From now on, signing in with your password asks for a code. The page shows a red Disable 2FA button instead, and the card 2FA recovery codes.

3. Add a passkey#

A passkey is a key pair kept in your device or password manager. You sign in with a fingerprint, a face scan or a device PIN, and there is no password to phish.

Press Add passkey, give it a name you will recognise (for example "Alex MacBook") and follow the prompt of your browser or device. The list then shows the passkey with its name, when you added it and when it was last used. Remove one from its row if you sell or lose that device. Add a passkey on at least two devices, or keep the password and two-factor as a fallback.

4. See where you are signed in#

The Login sessions card lists every browser session of your account.

1. This device. The session you are using now, with the browser and system, the IP address and when it was last active. It has no Sign out button. Every other row has one.
2. View full sign-in history (Auth Log). The link to the history in step 5.

To end one session, press Sign out on its row. To end all the others at once, press Sign out other sessions; your current session stays. Do this after you sign in on a shared computer, after losing a laptop, or when a row shows a device you do not know.

The list shows the IP address as SrvYard sees it. It does not show a country or city, so compare the browser name, the IP and the time with what you remember.

5. Read the sign-in history#

Choose View full sign-in history (Auth Log).

1. Status. Success or Failed.
2. Method. How the attempt was made, for example by password.
3. Reason. Why a failed attempt failed, as recorded. A successful row shows a dash.

The other columns are When (newest first), Device and Location, which shows the IP address. Failed attempts for your email address are listed too, even though they never reached your account, so a run of Failed rows you do not recognise means someone is guessing. A strong password, two-factor and a passkey make that harmless. Change your password if you see a success you did not make. The search box filters by IP, method or reason, and the list shows 25 rows a page.

6. Require two-factor for everyone#

An owner can make two-factor mandatory for the whole organisation. Open Organization settings > General.

1. Require two-factor authentication. "Members without two-factor authentication can only open their security settings until they turn it on." The switch applies to every member of the organisation.
2. Save changes. The setting takes effect when saved.

A member without two-factor can open only their security settings, profile, appearance and the organisation switcher, and can sign out. Every other page redirects to Security with a message that the organisation requires two-factor. They set it up in a minute and continue.

Tell your team before you turn it on, and make sure the owners have two-factor and saved recovery codes first.

Troubleshooting#

• The code is rejected. The clock on your phone is probably wrong. Switch on automatic time, wait a moment and try the next code. Codes change every 30 seconds.
• I lost my phone. At the sign-in prompt choose the Recovery code option and use one of your saved codes. Then turn two-factor off and set it up again on the new phone.
• "Too many attempts". Sign-in is limited to five tries a minute, and password confirmation and password changes to six. Wait a minute.
• The Security page keeps asking for my password. The confirmation lasts three hours. After that it asks again, by design.
• I cannot disconnect GitHub. You need another way to sign in. Create a password first.
• A new member is stuck on the Security page. The organisation requires two-factor. They must turn it on, or an owner can switch the requirement off.
• I lost the phone and the recovery codes. Contact support as described in Get help.

Related#

• Create your account, verify your email and set up two-factor: the first-day version.
• Rotate tokens and review the sign-in log: the same care for API tokens.
• Least privilege and auditing: who can do what in the organisation.
• Hardening checklist: firewall, SSH, updates: protect the servers too.