---
title: "HitKeep Two-Factor Authentication with TOTP and Passkeys | HitKeep"
description: "Secure your HitKeep account with TOTP (Google Authenticator) or Passkeys (WebAuthn). Step-by-step setup for hardware keys and authenticator apps."
canonical: "https://hitkeep.com/guides/security/two-factor-authentication/"
---

# HitKeep Two-Factor Authentication with TOTP and Passkeys

You have analytics data you don’t want anyone else accessing. A stolen password alone should never be enough to break in. HitKeep supports two second-factor methods: **TOTP** (time-based one-time passwords, compatible with any authenticator app) and **Passkeys** (WebAuthn, compatible with hardware security keys and platform authenticators). You can also generate **recovery codes** as one-time backup factors for account recovery.

![HitKeep security settings — TOTP and WebAuthn Passkey setup](https://hitkeep.com/_astro/security-2fa-setup.6Fs-AJ1k_Z1YtWLB.webp)

Settings → Security — TOTP authenticator app and hardware Passkey enrollment.

## TOTP (Authenticator App)

TOTP is compatible with Google Authenticator, Aegis, Bitwarden Authenticator, 1Password, and any RFC 6238-compliant app.

### Setup

1. Open **Settings → Security** in the HitKeep dashboard.
2. Under *Two-Factor Authentication*, click **Set up authenticator app**.
3. Scan the QR code with your authenticator app.
4. Enter the 6-digit code displayed in your app to confirm.

TOTP is now active. On future logins you will be prompted for the current code after entering your password.

### REST API Reference

- [Start TOTP setup](https://hitkeep.com/api/#tag/user/POST/api/user/security/totp/setup/start)
- [Verify TOTP setup](https://hitkeep.com/api/#tag/user/POST/api/user/security/totp/setup/verify)

### Disable TOTP

API reference:

- [Disable TOTP](https://hitkeep.com/api/#tag/user/POST/api/user/security/totp/disable)

## Passkeys (WebAuthn)

Passkeys replace your password entirely with a cryptographic credential stored on your device. Supported authenticators include:

- **Hardware keys:** YubiKey 5, FIDO2 USB keys
- **Platform authenticators:** Face ID, Touch ID, and Android biometrics

### Setup

1. Open **Settings → Security** in the HitKeep dashboard.
2. Under *Passkeys*, click **Add passkey**.
3. Follow your browser’s prompt to register your authenticator.

Once registered, you can log in by clicking **Sign in with a passkey** on the login page — no password needed.

![HitKeep login page with password sign-in and passkey sign-in options](https://hitkeep.com/_astro/page-login.B6TMdjCc_14aTyJ.webp)

The login screen exposes passkey sign-in directly, so enrolled users can authenticate without typing a password first.

### REST API Reference

- [Start passkey registration](https://hitkeep.com/api/#tag/user/POST/api/user/security/passkeys/register/start)
- [Finish passkey registration](https://hitkeep.com/api/#tag/user/POST/api/user/security/passkeys/register/finish)
- [Delete a passkey](https://hitkeep.com/api/#tag/user/DELETE/api/user/security/passkeys/%7Bid%7D)

### Passkey Login

API reference:

- [Start passkey login](https://hitkeep.com/api/#tag/auth/POST/api/auth/passkey/login/start)
- [Finish passkey login](https://hitkeep.com/api/#tag/auth/POST/api/auth/passkey/login/finish)

## Recovery Codes

Recovery codes are single-use backup codes for the case where you still know your password but no longer have your authenticator app or passkey device.

### Generate recovery codes

1. Open **Settings → Security** in the HitKeep dashboard.
2. Under *Recovery codes*, click **Generate codes** or **Regenerate codes**.
3. Store the displayed codes immediately.
4. Use **Copy all** or **Download .txt** to keep them somewhere safe.

Caution

Recovery codes are shown only when you generate or regenerate them. HitKeep stores only secure hashes of the codes and cannot reveal them later.

### Use a recovery code at login

1. Enter your email address and password.
2. On the MFA screen, choose **Use recovery code**.
3. Enter one of your unused recovery codes.

Each recovery code can be used exactly once.

### REST API Reference

- [Regenerate recovery codes](https://hitkeep.com/api/#tag/user/POST/api/user/security/recovery-codes/regenerate)
- [Verify an MFA recovery code](https://hitkeep.com/api/#tag/auth/POST/api/auth/mfa/recovery-code/verify)

## Emergency Recovery

If another instance owner is still able to log in, they can reset MFA for a locked-out user from **Administration → Users → Disable MFA**. This is an online, owner-only action and is the preferred operator workflow for cloud deployments.

If no owner can log in, the offline CLI recovery command is still available as break-glass recovery:

```
hitkeep recover disable-2fa --email user@example.com
```

See the [Recovery Guide](https://hitkeep.com/guides/security/recovery/) for full details.

## Social Sign-In and MFA

Google, GitHub, or Microsoft sign-in proves the account’s primary identity. It does not disable HitKeep MFA. When the resolved account has MFA enabled, the provider flow continues to the same TOTP, passkey, recovery-code, or email-link challenge before HitKeep creates the browser session.

Team OIDC SSO is different because the team’s identity provider owns its MFA and conditional-access policy. See [Social Sign-In](https://hitkeep.com/guides/security/social-sign-in/) and [OIDC Single Sign-On](https://hitkeep.com/guides/security/single-sign-on/) before choosing the provider model.

## Related

- [Recovery Guide](https://hitkeep.com/guides/security/recovery/)
- [Permissions & Roles](https://hitkeep.com/guides/admin/permissions/)
- [Social Sign-In](https://hitkeep.com/guides/security/social-sign-in/)
- [OIDC Single Sign-On](https://hitkeep.com/guides/security/single-sign-on/)
- [Configuration Reference](https://hitkeep.com/reference/configuration/)

Prefer not to manage authentication infrastructure yourself? [HitKeep Cloud →](https://cloud.hitkeep.eu/signup?plan=free&billing=monthly&utm_source=hitkeep_docs&utm_medium=referral&utm_campaign=cloud_signup&utm_content=docs_inline) handles backups, security updates, and account recovery automatically.

[Previous API clients](https://hitkeep.com/guides/security/api-clients/)[Next Account recovery](https://hitkeep.com/guides/security/recovery/)