---
id: "welcome/set-up-revenuecat/security"
title: "Account security"
description: "It's a dangerous world out there! But you can make things much safer by enabling two-factor authentication in your RevenueCat account settings."
permalink: "/docs/welcome/set-up-revenuecat/security"
slug: "security"
version: "current"
original_source: "docs/welcome/set-up-revenuecat/security.md"
---

> **AI agents:** This is the Markdown version of a RevenueCat documentation page. For the complete documentation index, see [llms.txt](https://www.revenuecat.com/docs/llms.txt).

It's a dangerous world out there! But you can make things much safer by enabling two-factor authentication in your RevenueCat account settings.

Once you do, you'll need a code generated on your mobile device any time you log in to your RevenueCat account.

:::info\[Password Security]
RevenueCat protects your account by securely checking if your password has been exposed in public data breaches. We won't allow using an unsafe password during sign-up. If we detect that your existing password has appeared in a data breach, you may also be required to reset your password before logging in. If this happens, use the "Forgot password" link on the login page to set a new, secure password.
:::

### Enabling Two-Factor Authentication

#### 1. Set up

Navigate to your [**Account > Security**](https://app.revenuecat.com/settings/security) settings in the RevenueCat dashboard and click **Set up** under Two-factor Authentication to begin the setup process.

![](https://www.revenuecat.com/docs_images/account/security.png)

#### 2. Scan barcode

You'll be prompted to re-enter your password. Once re-authenticated, you'll be presented with a QR code that you should scan with an authenticator app such as [Authy](https://authy.com/features/setup/) or [Google Authenticator](https://apps.apple.com/app/id388497605).

#### 3. Enter two-factor code

Enter the two-factor code from the authenticator app then click **Enable**.

![](https://www.revenuecat.com/docs_images/account/setup-2fa.png)

#### 4. Save recovery codes

Save your recovery codes. You'll only be shown these codes once, and are required if you ever lose access to your authenticator app. Some authenticator apps, like Authy, also provide their own backups in case you lose your phone.

:::info\[Save recovery codes in a safe place]
If you ever lose access to your two-factor code from your authenticator app (e.g. you got a new phone) the recovery codes are required to access RevenueCat.

For security reasons, RevenueCat Support may not be able to restore access to accounts with two-factor authentication enabled if you lose your two-factor authentication credentials or lose access to your account recovery codes.
:::

### Enforcing Two-Factor For Your Project

If you have invited collaborators to your app, you can check see if they've enabled two-factor authentication for their account on the [**Project > Collaborators**](https://www.revenuecat.com/docs/projects/collaborators) page.

Project Owners and Administrators also have the ability to enforce two-factor authentication for any new collaborators. With this setting enabled, invited collaborators will not be able to join your project until they've set up two-factor authentication for their account.

![](https://www.revenuecat.com/docs_images/projects/invite-collaborators.png)

:::warning\[Everyone must already have two-factor before enforcing]
Before you can enforce two-factor authentication for your project, all existing collaborators must already have two-factor authentication enabled. You can remove current collaborators and re-invite them if you need to enforce two-factor immediately.
:::

### Disabling Two-Factor Authentication

To disable two-factor authentication vavigate to your [**Account > Security**](https://app.revenuecat.com/settings/security) settings in the RevenueCat dashboard and click **Disable** under Two-factor Authentication.

![](https://www.revenuecat.com/docs_images/account/disable-2fa.png)

:::warning\[Leave projects that require two-factor before disabling]
If you are a collaborator on a Project that requires two-factor authentication, you must leave that project before disabling.
:::

### Setting Up Single Sign-On

Please refer to our [SSO guide](https://www.revenuecat.com/docs/projects/sso) for more information on activating SSO on your account.