Two-step verification

Three ways to get a code

You choose how the code reaches you. You can set up more than one.

• Authenticator app (recommended). An app on your phone makes a new 6-digit code every 30 seconds. It works with no cell signal and nothing is sent to you, so there's nothing to intercept. Read setting up an authenticator app.
• Text message. We text a code to your phone each time you sign in. Easy to start with, but it depends on your carrier and phone signal. See text messages from Composed Studio.
• Email. We email a code to your address each time you sign in. Handy as a backup. It's the least secure of the three, though, since anyone who can get into your email can read the code.

Turning it on

1. Open the account menu in any Composed Studio app.
2. Choose Sign-in & security.
3. Pick a method and choose Set up. We'll ask for your password first, then walk you through the rest.

When you finish, we'll show you a set of recovery codes. Save them somewhere safe before you leave the page. More on those below.

What sign-in looks like afterwards

Enter your email and password as usual. Then we'll ask for the code: open your app, or check your texts or email, and type it in. That's the whole thing.

If you sign in from the same browser often, you can tick Remember this browser for 30 days on the code screen and we won't ask for a code again on that browser until the 30 days are up. Changing your password or any two-step setting forgets every remembered browser, and you can forget them all yourself at any time from Sign-in & security. Some organizations turn this option off for their members.

Recovery codes

Recovery codes are one-time codes that get you in when your usual method isn't available: a lost phone, a new phone you haven't set up yet, no signal. Each one works once. Keep them somewhere safe and separate from your phone. Read recovery codes for the details.

If your organization requires it

Some organizations require two-step verification for everyone. If yours does and you haven't set it up yet, we'll ask you to at your next sign-in. Owners and Admins can read requiring two-step verification for your organization.

If you can't get a code

Start with a recovery code, then try any other method you set up. If neither gets you in, we can help. It takes a little time, and that's deliberate. Read lost access to two-step verification.