# Account security

Set up two-factor authentication, sign in with a passkey, see which actions ask for it, and what to do if you lose your second factor.

Source: https://usezn.com/docs/account-security/

Your zn account controls your API keys and, if you use Teams, your organization's policy, members and billing. This page explains how to protect it.

## Verify your email address

Your email address is your identity in zn: your API keys, your plan and your organization are tied to it. Until you verify it, creating, showing or revoking API keys, buying a plan, opening the billing portal and cancelling a subscription are refused with **Verify your email address, then sign in again**. Use the link in the verification email, then sign out and sign in again. The dashboard shows the same message until you do; you stay signed in. If the email did not arrive, use **Send the verification email again** on that message (one email every 10 minutes, up to 5 a day; it comes from security@usezn.com), check your spam folder, or write to security@usezn.com from that address.

## Two-factor authentication

Two-factor authentication asks for a second proof after your password: a code from an authenticator app, or a passkey or security key.

To set it up:

1. Open **Settings → Security** in the dashboard.
2. Select **Set up two-factor authentication**. You are taken to the sign-in page, where you add the authenticator app or the key.
3. Keep the recovery code you are shown somewhere safe, away from the device you use as your second factor.
4. You come back to **Settings**, which shows whether the current session signed in with two-factor authentication.

If you sign in with a **passkey**, that sign-in already counts as two-factor authentication: a passkey is tied to your device and protected by its lock (fingerprint, face or PIN).

## Who needs it

Two-factor authentication is optional for personal accounts. It is required for Team members, and for anyone who has turned it on.

| Your account | Create or show again an API key | Revoke an API key |
|---|---|---|
| Personal, without two-factor authentication | a sign-in from the last 10 minutes | a sign-in from the last 10 minutes |
| Personal, with two-factor authentication turned on | two-factor authentication and a sign-in from the last 10 minutes | a sign-in from the last 10 minutes |
| Member of an organization, any role | two-factor authentication and a sign-in from the last 10 minutes | a sign-in from the last 10 minutes |

Revoking a key or an agent token never asks for a second factor, only a recent sign-in: it can only take access away, and when a laptop is lost or a key leaks, cutting it off at once matters more than one more check.

## Actions that ask for it

Reading your data never asks for a second factor or a new sign-in. In an organization, owners and admins also need two-factor authentication for these actions:

| Action | Two-factor | Sign-in from the last 10 minutes |
|---|---|---|
| Create an agent token, change organization settings, approve a change in the dashboard | yes | yes |
| Invite someone, make a member an admin or an auditor, publish a policy | yes | no |
| Revoke an agent token | no | yes |
| Start a Team subscription, change the pay-as-you-go cap, open the billing portal (owner) | yes | no |

Removing a member, revoking an invitation or an installation, turning an admin back into a member, and buying or cancelling a personal plan do not ask for it.

When an action needs it, the dashboard shows **Two-factor authentication required** (or **Confirm it is you** when only a recent sign-in is missing). Follow the button, sign in, and you come back to the same page; then repeat the action. You stay signed in if you cancel.

In an organization, owners and admins need two-factor authentication for the Teams actions above, so they should set it up as soon as they join.

## If you lose your second factor

- **You have your recovery code:** on the two-factor step of the sign-in page, choose **Try another method → Recovery code**. You get a new recovery code afterwards; keep it.
- **You have neither:** write to security@usezn.com from the email address of your account. We verify that the request comes from you before we remove your second factor. If you are an owner or admin of an organization, we also confirm it with another owner or admin of that organization, or through its billing contact. Then sign in and set up two-factor authentication again.

## Keys and tokens

API keys and agent tokens are separate from your sign-in: anyone who has one can use it until it expires or is revoked, whether or not they know your password. If a laptop is lost or a key leaks, revoke it in the dashboard (**API keys**, or **Teams → Agent tokens**) and create a new one. zn-gate keeps agent tokens in the system keychain, out of agent configuration files.

## Delete your account

**Settings → Delete account** asks you to type a confirmation word. Your account is then marked for deletion and its API keys stop working at once. You can cancel from the same page within 30 days; after that we delete your account and its data and confirm by email.