Setting up two-step verification and saving recovery codes

A second step (a passkey or authenticator app) is optional unless your workspace owner requires it. It protects your account even if someone reads your email, lets you sign in without waiting for an email (passkey), and is needed for admin tasks.

If your workspace requires it, you set it up right after you accept an invitation or the first time you sign in. Otherwise you can add it any time in Settings, Security. You choose a passkey, an authenticator app, or both. We recommend registering a passkey, and keeping an authenticator app as a backup.

Option A: register a passkey

1. When CM Chat asks you to set up two-step verification, choose Passkey (marked Recommended).
2. Give it a name you will recognise, such as "Work laptop", in Name this passkey.
3. Click Create passkey.
4. Your device asks you to confirm with your fingerprint, face, PIN, or security key. Do that.
5. If this is your first second step, CM Chat now shows your recovery codes. Go to "Save your recovery codes" below.

You can add more passkeys later (for example, one on your phone and one on your laptop). Click your name at the bottom of the sidebar, then Security. Under Passkeys, click Add passkey.

Option B: set up an authenticator app

1. Install an authenticator app on your phone if you do not have one.
2. In CM Chat, choose Authenticator app.
3. A square QR code appears. In your app, choose to add an account and scan the code. If you cannot scan, type the shown secret into the app instead.
4. Type the 6-digit code your app now shows into the 6-digit authenticator code boxes.
5. Click Verify and turn on.
6. CM Chat shows your recovery codes. Go to the next section.

Save your recovery codes

Recovery codes are your emergency way in if you lose your phone or passkey.

1. You will see 10 codes that look like xxxx-xxxx-xxxx.
2. They are shown only once. Save them now.
3. Click Copy all, Download .txt or Print. Keep them in a password manager, or on paper somewhere safe, like a locked drawer.
4. Do not store them in the same place as your phone, and do not send them by chat or email.
5. Tick I saved these codes somewhere safe, then click Continue (or Continue to CM Chat).

Each code works one time. You can see how many you have left under Security in your settings.

Making a new set of codes

1. Click your name at the bottom of the sidebar, then Security.
2. Under Recovery codes, click Generate new codes, then confirm with Generate new codes again.
3. CM Chat asks you to confirm it is you, with your authenticator code or passkey.
4. New codes appear. All your old codes stop working. Save the new ones.

Removing a method

You can remove a passkey or your authenticator app from Security after confirming it is you. You cannot remove your last second step. Add another first.