Account security

Turn on two-factor auth, review active sessions, and manage scoped API keys.

Protect your account with two-factor authentication, review where you’re signed in, and manage keys for programmatic access.

Two-factor authentication#

  1. 1

    Enable two-factor

    In Settings, open Two-factor authentication and click enable. Add the setup key (or scan the URI) to an authenticator app.

  2. 2

    Verify a code

    Enter the 6-digit code your app shows to turn it on.

  3. 3

    Save recovery codes

    Store the recovery codes somewhere safe — each one works once if you lose your authenticator.

With two-factor on, every sign-in asks for a code. Lost your device? Enter a recovery code instead.

Active sessions#

The Active sessions list shows every device signed in, with its browser, OS, IP, and sign-in time. Sign out a single device, or use “Sign out other devices” to end every session except the one you’re using.

API keys & scopes#

Create an API key in Settings → API keys for the CLI, SDK, or REST API. Give it a name and a scope:

Full access
Everything the account can do, including sensitive resources like API keys and webhooks.
Read only
Read resources but make no changes.
Read & write
Read and modify most resources (excludes sensitive ones like API keys and webhooks).

Keys start with gh_ and are shown only once at creation — copy it then. Keys are stored hashed, and you can revoke one any time.

✦ Your account is protected by a second factor, and machine access uses scoped keys you can revoke.