Two-step verification (2FA) for your ContentForge account and team

Two-step verification asks for a 6-digit code from an app on your phone each time you sign in, as well as your password. Someone who learns your password still can't get in without your phone.

Turn it on

1. Go to Settings → Profile and find Two-step verification.
2. Click Turn on two-step verification, then Start setup.
3. Open an authenticator app on your phone (for example Google Authenticator, Microsoft Authenticator or 1Password) and scan the QR code. Can't scan it? Choose to add an account by key in the app and type the key shown under the QR code (Copy key copies it).
4. Enter the 6-digit code the app shows and click Turn on.
5. Save your recovery codes. You see 10 codes once. Copy or download them and keep them somewhere safe (a password manager is ideal). Tick I've saved my recovery codes somewhere safe and click Continue.

You get an email saying two-step verification is on.

Signing in with it on

After your password you see Enter your code. Type the 6-digit code from your app and click Verify.

• Remember this device for 30 days: tick it on a computer or phone only you use. That browser won't ask for a code for 30 days. You get an email naming the device. Don't tick it on a shared computer.
• Lost your phone? Use a recovery code: see below.

Every page and every action in ContentForge needs the second step, including the website editor and the screen where you allow an AI assistant to connect to your account.

Lost your phone? Use a recovery code

1. On Enter your code, click Lost your phone? Use a recovery code.
2. Type one of your saved codes (dashes and capitals don't matter) and click Use recovery code.
3. Your old authenticator app is removed and you go straight to setting up a new one. You get new recovery codes at the end.

Each recovery code works once. You get an email when one is used.

No recovery codes left? Ask your agency's Owner or an Admin to reset your two-step verification. If you're the Owner, open a ticket from Help → Submit a Ticket.

Manage it on Settings → Profile

• Replace app: moving to a new phone. Set up the new app; the old one stops working and you get new recovery codes.
• Make new codes: enter a code from your app to get 10 new recovery codes. The old ones stop working.
• Remembered devices: every device you ticked Remember this device on, with when it was remembered and last used, and This device on the one you're using. Click Forget (or Forget all) and that device asks for a code next time.
• Turn off: enter a code from your app. Your recovery codes and remembered devices are removed too, and you get an email. You can't turn it off while your agency requires it (you can replace your app instead).

ContentForge staff manage theirs on Profile.

Require it for your team (Owners and Admins)

1. First turn it on for your own account.
2. Go to Settings → Team Members and find Two-step verification.
3. Switch on Require two-step verification for my team.
4. Choose Time to set it up: 7 days (people can click Skip for now until then) or None (they must set it up at their next sign-in).

Everyone on your team, you included, is asked to set it up the next time they sign in. Until they do (and once the 7 days are up), they can't use ContentForge: every page sends them to the setup screen. The card lists who has it on.

Reset it for someone who lost their phone (Owners and Admins)

On Settings → Team Members → Two-step verification, click Reset 2FA next to the person, then Reset. Their authenticator app, recovery codes and remembered devices are removed and they get an email saying it was reset. They set it up again at their next sign-in.

• The Owner can reset Admins and Members; Admins can reset Members.
• Nobody can reset the Owner's here. The Owner uses a recovery code, or opens a ticket from Help → Submit a Ticket: ContentForge support can reset it after checking who they're talking to, and the Owner gets an email when they do.
• If the person also uses the same sign-in with another agency, you can't reset it. They use a recovery code instead.

Your clients' portals

• Default for every client: Settings → Olympus → Two-step verification for client portals. Switch on Require two-step verification for clients' people and choose the time to set it up.
• One client: the client's Client Access tab → Two-step verification → Use my default, Required or Not required. The same card lists the client's people with 2FA on or 2FA off, and has Reset 2FA for someone who lost their phone.

Clients see your branding on their sign-in and setup screens and in their emails. See Two-step verification in the client portal.

API keys and AI assistant connections

API keys and AI assistant connections keep working with two-step verification on, because they don't sign in with a password each time. Making a key, and allowing an AI assistant to connect, happen while you're signed in, so they need the second step. To stop a key or connection, revoke it on Settings → API & MCP.

Limits and what it can't do

• Authenticator apps only. Text-message and email codes aren't available.
• Up to 5 remembered devices. Remembering a 6th forgets the oldest.
• 10 wrong codes in 15 minutes (5 for recovery codes) pauses tries for a few minutes.
• A reset or recovery code removes all your remembered devices too.

Troubleshooting

• "That code didn't work": check the time on your phone is set automatically, and use the newest code (they change every 30 seconds).
• "Turn on two-step verification for your own account first": you have to use it yourself before you require it for the team.
• "Two-step verification is required for your account, so it can't be turned off": your agency requires it. Use Replace app to move to a new phone.
• I'm asked for a code on a device I remembered: the 30 days ran out, you forgot the device, cleared your cookies, or your two-step verification was reset.
• A teammate can't get past the setup screen: they need to finish setup (scan, enter a code, save the codes). If their 7 days are up, Skip for now isn't offered.