# Two-factor authentication (2FA)

Two-factor authentication (2FA) is an authentication process requiring users to utilize two different forms of verification. 2FA for your Ably account requires your password and a time-based one-time password (TOTP) from an authenticator app.

Access your [security settings](https://ably.com/users/settings/security) to configure two-factor authentication for your Ably account.

## Enable 2FA 

To enable 2FA for your own user login:

1. Log in to your [account](https://ably.com/accounts/any) and go to [Security](https://ably.com/users/settings/security).
2. Click **Enable** on the **Two-factor authentication** card.
3. Enter your password in the dialog to confirm.
4. Scan the QR code into an authenticator app such as Google Authenticator or 1Password.
5. Enter the generated code to verify.
6. Store your recovery codes in a safe location.

### Disable 2FA 

To disable 2FA for your own user login:

1. Log in to your [account](https://ably.com/accounts/any) and go to [Security](https://ably.com/users/settings/security).
2. Click **Disable** on the **Two-factor authentication** card.
3. Enter your password in the dialog to confirm.

### SMS 2FA 

<Aside data-type='note'>
SMS-based 2FA is deprecated. Users who previously enabled SMS 2FA remain supported, but new setups use TOTP.
</Aside>

## Enforce 2FA for all users 

[Account owners](https://ably.com/docs/platform/account/team.md?source=llms.txt) can require 2FA to be utilized by all users. Any user that hasn't already enabled 2FA will be prompted to do so the next time they attempt to access the account.

<Aside data-type='note'>
The account owner must already have 2FA enabled for their own login before they can enforce it account-wide.
</Aside>

To enforce 2FA for all users:

1. Log in to your [account](https://ably.com/accounts/any) and go to the account [Security](https://ably.com/accounts/any/security) page.
2. Toggle **Require Two-Factor Authentication for all account users** under the **Authentication Settings** section.
3. **Save** the authentication settings.

### Remove 2FA requirement of all users 

To remove the requirement for all users to authenticate with 2FA:

1. Log in to your [account](https://ably.com/accounts/any) and go to the account [Security](https://ably.com/accounts/any/security) page.
2. Toggle **Require Two-Factor Authentication for all account users** under the **Authentication Settings** section.
3. **Save** the authentication settings.

## Related Topics

- [Overview](https://ably.com/docs/platform/account.md?source=llms.txt): Overview of the Ably dashboard for managing apps, account settings, team, billing, and usage.
- [Team](https://ably.com/docs/platform/account/team.md?source=llms.txt): Manage users, roles, and team access in your Ably account.
- [Organizations](https://ably.com/docs/platform/account/organizations.md?source=llms.txt): Manage Ably organizations, provision users, configure SSO with SCIM, and handle account roles.
- [Single sign-on (SSO)](https://ably.com/docs/platform/account/sso.md?source=llms.txt): Single sign-on enables users to authenticate with Ably using your own identity provider.
- [Enterprise customization](https://ably.com/docs/platform/account/enterprise-customization.md?source=llms.txt): How Enterprise customers can create a custom endpoint and benefit from Active Traffic Management and other advanced Ably features.
- [Access tokens](https://ably.com/docs/platform/account/access-tokens.md?source=llms.txt): Create and manage access tokens to authenticate with the Ably Control API and Ably CLI, including expiration and rotation.
- [Programmatic management using Control API](https://ably.com/docs/platform/account/control-api.md?source=llms.txt): The Control API is a REST API that enables you to manage your Ably account programmatically. This is the Control API user guide.

## Documentation Index

To discover additional Ably documentation:

1. Fetch [llms.txt](https://ably.com/llms.txt?source=llms.txt) for the canonical list of available pages.
2. Identify relevant URLs from that index.
3. Fetch target pages as needed.

Avoid using assumed or outdated documentation paths.