Two-factor authentication

Two-factor authentication (2FA) adds a second check to sign-in, so a stolen password or hijacked inbox is not enough on its own. In Laya, passkeys are the primary second factor and an authenticator app is the fallback, with single-use recovery codes as a safety net.

How it works

• Passkeys — the primary factor: Face ID, Touch ID, Windows Hello or a security key. You can add several, and each can be renamed or removed.
• Authenticator app — the fallback: a 6-digit code from an app such as Authy or 1Password.
• Recovery codes — single-use codes issued when you enrol your first factor, for when you lose your devices.

Once 2FA is on, it is enforced on every route in — password, magic link, and every "continue with" social button. The Two-factor authentication card on the Security page shows an On / Off pill so you always know its current state.

Add a passkey

1. Open the Security pageOpen your avatar menu (top right) and choose Security, then find the Two-factor authentication card.
2. Select Add a passkeyYour browser or device prompts you to create it with Face ID, Touch ID, Windows Hello or a security key.
3. Store your recovery codesWhen you enrol your first factor, Laya shows a set of single-use recovery codes exactly once. Use Copy codes or Download .txt, tick "I've stored these codes somewhere safe.", then select Done.

The card now shows On. Each passkey row shows when it was added and last used, whether it is "Synced across your devices" or "This device only", and offers Rename and Remove.

Set up an authenticator app

1. Select Set up authenticator appOn the same card. The authenticator is the fallback factor — a 6-digit code from an app such as Authy or 1Password.
2. Scan the QR code or copy the secretThe QR code is generated entirely in your browser, so the secret never leaves your device.
3. Enter the 6-digit code and select Confirm and enableLaya verifies the code and enables the authenticator.

Recovery codes

Recovery codes are shown once, when your first factor is enrolled — after that the card only shows how many unused codes you have left. Each code works a single time.

Generate new codes always asks you to prove a factor first — a passkey tap or a typed code. An active session alone is never enough.

Signing in with 2FA

After your password, magic link or social sign-in succeeds, Laya asks for your second factor — a passkey if you have one, or a 6-digit authenticator code. If you have lost your devices, use one of your recovery codes.

Turning 2FA off

There is no single off switch: to turn two-factor off entirely, remove every passkey and your authenticator app from the card. Laya asks you to confirm before the last one goes, and removing a factor only requires a fresh proof when it would leave the account with no second factor.