Security and access
Security and access
Open Settings → Account to manage the ways you sign in and the devices that can use your account.
Verify your email
If your email address isn’t confirmed yet, Twelfth shows a banner across the app that reads “Verify your email to secure your account” and names the address the link was sent to. Choose Resend email if you need another link. Your verified status is also shown as a Verified badge next to your address in Profile.
If you joined from a workspace invitation, your email is confirmed automatically when you accept, so you won’t see the banner. It only appears for self sign-ups whose address hasn’t been confirmed yet.
Sign-in methods
Use your Twelfth email and password, or sign in with Google or a Microsoft work or school account. Both buttons are on the front of the login page; passkeys, email and password and single sign-on are under See other login methods. See Signing in for every option.
Settings → Account → Sign-in methods lists what is attached to your account and offers Link Microsoft or Link Google for the providers you haven’t added. Linking needs the provider account to use the same email address as your Twelfth account. Once linked, you can sign in either way, and your password keeps working.
To remove a provider, open the ⋯ menu on its row and choose Disconnect, then confirm. Twelfth won’t let you disconnect your only way to sign in: link another provider or set a password first. If you signed in a while ago, you may be asked to sign out and back in before disconnecting.
A provider can also attach itself the first time you use it on the login page, when the address is verified on both sides:
- Google verifies the address it returns, so a Google sign-in with your Twelfth email attaches to your account straight away.
- Microsoft only counts an address as verified on the login page when the organisation that owns the account has verified the email’s domain in Microsoft Entra, which is the case for a normal company tenant. Otherwise that sign-in is refused and you keep the method you started with; use Link Microsoft in Settings instead. This is deliberate: an Entra administrator can put any address on a user in their own tenant, and the domain check is what stops that becoming someone else’s account. Link Microsoft doesn’t need the check, because you start it already signed in to your own account.
Microsoft asks which account to use each time, so a person with a seat in more than one tenant is never signed in as the wrong one silently.
Two-factor authentication
2FA uses a code from an authenticator app, such as 1Password, Google Authenticator, or Authy.
- Start setup. Select Set up 2FA and confirm your password if asked.
- Scan the QR code. Scan the Twelfth QR code with your authenticator app.
- Save recovery codes. Save the one-time recovery codes somewhere secure.
- Verify the code. Enter the current authenticator code.
Password sign-ins then require a current code. Trusted devices expire after 30 days.
Do not store recovery codes only in the same password manager or device that you use for your authenticator app. Each recovery code can be used once.
You can disable 2FA here unless your workspace requires it.
Passkeys
Passkeys let you sign in with your device biometrics, device PIN, or a security key. Select Add passkey and complete the device prompt. Keep another sign-in method before removing one.
Signed-in sessions
Review Signed-in sessions and sign out any device you do not recognise. Change your password if you think your account was exposed.