Configure two-factor authentication
Two-factor verification and access
Enable 2FA under Settings > Your account: scan the QR with your authenticator, confirm the code and store the ten one-use backup codes shown during activation.
When an organization requires 2FA and you have not configured it, complete setup before continuing. Protection also applies to dashboard requests, not only the visible screen. Actions needed to set up 2FA, confirm identity or sign out remain available.
If a sensitive action asks you to verify your identity again, complete it before retrying. Team permissions still apply; enabling 2FA does not grant refund or business administration permissions.
Signing in with 2FA
Each code from your authenticator app works only once, and each backup code is spent when used.
From the third failed code in a day, Cord sends you the email Sign-in attempt with your password (at most one per hour). Whoever tried it typed your correct password: if it wasn’t you, change it under Settings › Your account and sign out the sessions you don’t recognize. After ten failed codes in 24 hours, the second step is paused except from a network where you already have an open session; resetting your password lifts the pause.
Availability of the September improvements is being verified. See scope and release status; contact support if a described action is not yet shown in your account.
Idle sign-out: implementation under validation
The timeout configured by the business in Settings › Security is checked when entering the app, billing and protected internal APIs. Once it expires, the operation stops and you must sign in again. Passkey enrollment also checks it.
Visiting a public page or using 2FA recovery routes does not restart this window. Activity means authenticated requests to protected surfaces, not mouse movement; automatic app requests may also count. A value of zero disables the idle timeout while retaining the maximum session lifetime, revocation and account suspension.
Checking and refreshing activity happen together so concurrent requests cannot renew an already expired session. This protection has local tests; publication and integrated sign-in acceptance remain to be verified.