With two-factor authentication (2FA), signing in takes your password plus a 6-digit code from an authenticator app on your phone. It protects your account, and so every workspace you belong to, even if your password leaks.
2FA is a personal choice. Each team member turns it on for themselves; an Owner cannot require it or see who uses it.
Before you start
Install an authenticator app on your phone, such as Google Authenticator, 1Password or Authy. Samba does not send codes by SMS or email.
Turn it on
Select your picture in the top right corner, then User settings.
Scroll to Security and select Enable two-factor authentication.
If asked, confirm your password. One confirmation lasts 3 hours.
Scan the QR code with your authenticator app, or type the setup key into it.
Enter the 6-digit code the app shows.
Save the 8 recovery codes Samba displays somewhere safe, such as a password manager.
2FA is only on once Samba has accepted a code in step 5. If you close the page before that, your account stays on password-only sign-in.
What happens next
Each time you sign in with your email and password, Samba asks for the current code from your app, or for one of your recovery codes.
A recovery code works once. Samba replaces it with a new one, so you always hold 8.
Continue with Google does not ask for a code. Samba treats your Google sign-in as the second step.
Manage recovery codes or turn 2FA off
Go back to User settings → Security. After confirming your password you can:
View your current recovery codes.
Regenerate them. All old codes stop working and 8 new ones replace them. Do this if you think someone has seen them.
Disable 2FA. Your account returns to password-only sign-in and the recovery codes are discarded.
Resetting a forgotten password does not turn 2FA off.
I lost my phone
I lost my phone
Sign in with one of your recovery codes, then disable 2FA and set it up again on your new phone. If your Samba email is a Google account, you can also sign in with Continue with Google, which skips the code.