Security & two-factor

Your Snap studio holds client photos and payment relationships. Two-factor adds a second lock to sign-in, and because recovery is where accounts actually die, this page states plainly how it works: there is deliberately no automated bypass — not for you, not for anyone pretending to be you.

Turn on two-factor

It takes about two minutes, and any authenticator app works — Google Authenticator, 1Password, Authy, Microsoft Authenticator.

1. 1
   Open Settings → Security and click Enable two-factor. Snap asks for your password to start.
2. 2
   Scan the QR code with your authenticator app — or paste the secret manually if you can't scan. Enter the 6-digit code the app shows and click Verify and turn on.
3. 3
   Save your backup codes — ten codes, shown once. Use Download .txt, keep the file somewhere safe, then click I've saved them.

From then on, every sign-in asks for your password and a code. There's no "remember this device" option — the code is asked every time, which is the point.

Note: Two-factor protects a personal login, not the studio: each team member enables it on their own account.

Backup codes

Each backup code works exactly once — for a broken phone, a wiped authenticator, or a device you don't trust with your secrets. They're shown once at setup and never again, which is why the download button exists. Used one, or lost the file? Click Regenerate backup codes on the same settings page (it asks for your password): a fresh set appears and the old codes stop working immediately.

What changes when it's on

• Enabling signs out every other session. Anything still signed in with just a password has to pass the code check too.
• A password reset revokes all active sessions, so a stolen session can never outlive a recovered account.
• Wrong codes have consequences: code verification is rate-limited, and repeated failures lock it briefly.
• Secrets are stored encrypted — both the authenticator secret and the backup codes — and every enable, disable, and backup-code use is written to the audit log.

Lost device and recovery

If you still have backup codes: sign in with your password plus any remaining code, then re-enroll a new authenticator from Settings → Security.

If you've lost both the device and every code, email hello@snaphq.app from your account's email address. We verify your identity before resetting two-factor — there is no self-serve bypass, because anything a thief could click through wouldn't be security at all.