> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ouraicalling.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Account security

> Protect sign-in with an authenticator app or email codes and review active device sessions.

Open **Settings → Preferences** to manage sign-in security for your user account.

## Two-factor authentication

Two-factor authentication adds a second step after the password. You can enable either or both methods:

* **Authenticator app:** scan the QR code with any TOTP-compatible app and enter its current 6-digit code.
* **Email codes:** confirm the first 6-digit code sent to your account email. Future sign-ins send a new code that expires after 10 minutes.

Turning a method on or off always requires a successful code confirmation. If both methods are enabled, the sign-in screen lets you switch between them.

Email-code messages use the workspace SMTP relay on a whitelabel workspace or domain. Customer workspaces inherit their reseller's relay. When no workspace relay is configured, the platform SMTP configuration is used.

<Note>
  MFA management is intentionally limited to an interactive Supabase user session. It is not exposed through API keys or MCP because those credentials must not be able to weaken the account's sign-in policy.
</Note>

## Where you are signed in

The same Preferences page lists tracked devices with active native Auth sessions. The list shows the browser, operating system, last activity time, and IP address when available.

Choose **Sign out** on a device you do not recognise. This revokes that session's refresh-token family and immediately blocks its remaining access token from platform APIs and database access.

For privacy and security, the platform stores the native session ID and device metadata only. Access tokens and refresh tokens are never stored in the device list.