Account security
Turn on two-factor auth, review active sessions, and manage scoped API keys.
Protect your account with two-factor authentication, review where you’re signed in, and manage keys for programmatic access.
Two-factor authentication#
- 1
Enable two-factor
In Settings, find Two-factor authentication and click Enable. Scan the QR code with an authenticator app, or enter the setup key.
- 2
Verify a code
Enter the 6-digit code your app shows, then click "Verify & enable".
- 3
Save recovery codes
Store the recovery codes somewhere safe. If you lose your authenticator, each code works once.
With two-factor on, every sign-in asks for a code. If you lose your device, enter a recovery code instead.
Active sessions#
The Active sessions list shows every device signed in, with its browser, OS, IP, and sign-in time. Sign out a single device, or use “Sign out other devices” to end every session except the one you’re using.
API keys and scopes#
Create an API key in Settings → API keys for the CLI, SDK, or REST API. Give it a name and a scope:
- Full access
- Everything the account can do, including sensitive resources like API keys and webhooks.
- Read only
- Read resources but make no changes.
- Read & write
- Read everything and change most resources. It can't change sensitive ones such as API keys, webhooks, team members, and billing, and it can't reveal credentials.
Keys start with gh_. We show a key only once, when you create it, so copy it then. We store only a hash of each key, and you can revoke a key at any time.
✦ Your account is protected by a second factor, and machine access uses scoped keys you can revoke.