Skip to main content
Account security protects your own sign-in. Organization security sets requirements for people accessing an organization. These controls serve different scopes, so check which settings page you are using.

​
Set up an authenticator

1

Open account security

Open your account menu and choose Sign-in and security. Select Set up MFA.
2

Confirm your identity

Enter your current password when requested. If your account uses a sign-in provider, complete a recent provider sign-in when prompted.
3

Add AMLOK to your authenticator

Scan the displayed QR code in your authenticator app, or use the manual setup key. Enter the current six-digit code and select Verify and enable MFA.
4

Save recovery codes

Download or securely store the recovery codes and confirm that you saved them. Each code can be used once if you lose access to the authenticator.
MFA setup is complete only after verification. Keep QR codes, setup keys and recovery codes private; do not include them in screenshots or support messages.

​
Review sessions and password security

In account security, inspect the session list and identify your current session. Revoke an unfamiliar session or use Sign out other sessions when appropriate. Review the available security activity to understand recent changes. Accounts with a password can use Change password after identity confirmation. Changing the password signs out other sessions. If you cannot sign in, use Forgot your password? from the sign-in page. Provider-based accounts should also protect access to their Microsoft, Google or GitHub account.

​
Require MFA for an organization

An Owner can open Organization security and change the organization’s MFA requirement. Members must enroll an authenticator before accessing organization data when the policy requires it; account security remains accessible for enrollment. Owner management actions can also require MFA or a fresh identity check. If you encounter such a prompt, complete the requested setup or sign in again, then return to the action. Do not ask a colleague to share an authenticator code. Disabling MFA is blocked when an organization you belong to requires it. Review your team membership and organization requirements before changing authentication settings.

​
If access is lost

Use an unused recovery code if you cannot access your authenticator. If you cannot recover access, contact support@amlok.io from your registered address and describe the affected organization and sign-in method. Do not send passwords, provider tokens or recovery codes. See account access for expired invitations and troubleshooting for workspace access issues.