Account security
Manage your profile and password, enable multi-factor authentication, keep recovery codes, and sign out other sessions.
- Who can use this
- Every signed-in user manages their own account
- Owners and admins must enable MFA before privileged changes
On this page
Explore overview diagram
Overview diagram
Account security
Overview diagram. The text on this page has the exact steps and permissions.
Overview
Your account profile holds your name, avatar, password, multi-factor authentication, and active sessions.
Profile
Update your first name, last name, display name, and avatar from your account profile.
Multi-factor authentication
-
1
Create a password first if you signed up with another method.
-
2
Start MFA setup and scan the code with an authenticator app.
-
3
Confirm with your current password and a verification code.
-
4
Save or download your recovery codes. Each code works once if you lose access to your authenticator app.
Note
Keep your recovery codes somewhere safe
Store your recovery codes in a password manager, not in Flopinio. If you lose your phone, a recovery code is how you get back in. Each code works once.
When MFA is required
Owners and admins must have MFA enabled before privileged changes such as managing members, teams, custom fields, client portal access, integrations, mailbox rules, and subscription billing.
Recent sign-in checks
Sensitive actions ask you to confirm your identity if you have not signed in recently. Regenerating recovery codes, resetting MFA, and turning MFA off also require a recent sign-in.
Sessions
Review your active sessions and revoke any you do not recognize, or sign out of all sessions at once. You cannot revoke the session you are using from that list. Password changes, password recovery, and signing out all sessions also revoke connected MCP access and refresh credentials; reconnect those clients afterward.
FAQ
What if my stored MFA data can no longer be read?
The security tab will ask you to reset stored MFA data. After the reset, start setup again to re-enable MFA.
I lost my phone. How do I sign in?
Use one of your recovery codes instead of a verification code. Then set up MFA again on your new phone and generate new recovery codes.