Docs Account, plans & billing
Account, plans & billing
Account security
Turn on two-factor authentication, keep your recovery codes safe, use a strong password, and log out of sessions you don't recognise. On kumo.io you do all of this in your Kumo.io account; on a self-hosted installation, in Settings.
Where your security settings live
| You use | Go to |
|---|---|
| A workspace on kumo.io | Security at https://account.kumo.io, which opens Login & Security. You log in to your workspace with your Kumo.io account, so your workspace's Settings → Profile & Security shows a notice with an Open Your Kumo.io Account link instead of these controls. |
| A self-hosted installation | Settings → Profile & Security in that installation. |
Both places offer the same three sections: Two-Factor Authentication, Password and Active Sessions.
Turn on two-factor authentication
Two-factor authentication protects your login with a time-based one-time code from an authenticator app.
- In Two-Factor Authentication, choose Enable Two-Factor.
- Scan the QR code with your authenticator app. If you can't scan it, choose Or enter the key manually and type the key into the app (Copy Secret Key copies it).
- Enter the current code from the app in Enter the current code and choose Confirm.
- Kumo.io shows your recovery codes. Save them now (Copy All Recovery Codes copies them) and choose I've Saved My Recovery Codes.
From then on, Kumo.io asks for the 6-digit code from your authenticator app each time you log in. Each code is accepted only once.
Recovery codes
You get 10 recovery codes. Each one works once, in place of an authenticator code, if you lose your phone or app. They are shown only when they are created, so store them somewhere safe, such as a password manager.
To replace them, enter a current authenticator code in Authenticator Code and choose New Recovery Codes. The new set replaces the old one immediately: the old codes no longer work.
Turn off two-factor authentication
Enter a current code in Authenticator Code, expand Turn Off Two-Factor, enter your Password, and choose Turn Off. Kumo.io logs you out of your other devices, so log in again there.
Change your password
In Password, enter your Current Password and a New Password of at least 10 characters, then choose Change Password. Changing your password logs out your other sessions.
If you have forgotten your password, choose Forgot Password? on the login page instead. Kumo.io emails you a reset link if an account exists for that address.
Review and end sessions
Active Sessions lists everywhere you are logged in, with how you logged in (for example Password + Authenticator code), when you logged in and when the session was last used. Your current session is tagged This Session.
If you don't recognise a session, choose Log Out next to it. You can't end your current session from this list; use Log Out in the navigation for that.
Require two-factor authentication for everyone (self-hosted)
On a self-hosted installation, an administrator can require every member of the account to use two-factor authentication:
- Open Settings → Profile & Security.
- In Account MFA Policy, select Require two-factor authentication for all members.
Members who haven't set up an authenticator app are taken through Set Up Two-Factor Authentication at their next login and must enter a code (Enable and Log In) before they get in. Changing the policy needs permission to manage single sign-on for the account.
Requiring two-factor authentication for every member is not available for workspaces on kumo.io yet. Each person can still turn it on for their own Kumo.io account.
Good habits
- Turn on two-factor authentication, and keep your recovery codes outside the device that runs your authenticator app.
- Use a unique password that you don't use anywhere else.
- Check Active Sessions now and then, and log out of anything you don't recognise.
- Don't share a login. Give each teammate their own access, and use API tokens for automation. See How do I authenticate to the API?