# Account security

> Turn on two-factor auth, review active sessions, and manage scoped API keys.

Source: https://gheima.ma/docs/account-security

Protect your account with two-factor authentication, review where you’re signed in, and manage keys for programmatic access.

### Two-factor authentication

1. **Enable two-factor** — In Settings, find Two-factor authentication and click Enable. Scan the QR code with an authenticator app, or enter the setup key.
2. **Verify a code** — Enter the 6-digit code your app shows, then click "Verify & enable".
3. **Save recovery codes** — Store the recovery codes somewhere safe. If you lose your authenticator, each code works once.

> Note: With two-factor on, every sign-in asks for a code. If you lose your device, enter a recovery code instead.

### Active sessions

The Active sessions list shows every device signed in, with its browser, OS, IP, and sign-in time. Sign out a single device, or use “Sign out other devices” to end every session except the one you’re using.

### API keys and scopes

Create an API key in Settings → API keys for the CLI, SDK, or REST API. Give it a name and a scope:

- `Full access`: Everything the account can do, including sensitive resources like API keys and webhooks.
- `Read only`: Read resources but make no changes.
- `Read & write`: Read everything and change most resources. It can't change sensitive ones such as API keys, webhooks, team members, and billing, and it can't reveal credentials.

> Note: Keys start with gh_. We show a key only once, when you create it, so copy it then. We store only a hash of each key, and you can revoke a key at any time.

> Result: Your account is protected by a second factor, and machine access uses scoped keys you can revoke.

---

All docs: https://gheima.ma/docs.md