Two-factor authentication and account security

Add a six-digit code on top of your password so a stolen email + password can't get into your Yesoma workspace. Yesoma supports TOTP authenticator apps (Google Authenticator, 1Password, Authy, Microsoft Authenticator — anything that scans a QR code).

Turn it on for yourself

1. Go to /security/mfa (paste this after getyesoma.com in your address bar, or use the link from a setup email if Yesoma support sent you one).
2. Click Start setup. A QR code appears.
3. Open your authenticator app and scan the code. The app starts showing a fresh 6-digit code every 30 seconds.
4. Type the current code into Yesoma and click Verify.

The new authenticator entry is labeled Yesoma and shows your account email. You're enrolled once the code is verified. Next time you sign in, after your password you'll be asked for a code. Open your app, type the 6 digits, you're in.

If setup is optional, choose Not now before starting or Cancel setup after the QR code appears to return to Yesoma. Canceling removes the unfinished enrollment. If your workspace requires MFA, you cannot silently bypass enrollment, but you can choose Sign out instead or Cancel and sign out and return later. Yesoma signs you out, removes the unfinished factor when the authentication service is available, and always clears abandoned unverified factors before issuing a fresh QR code on the next attempt.

If required MFA is preventing a Workspace Owner or Admin from reaching the setting that enabled it, the enrollment page also shows Turn off requirement and continue. Confirming this explicitly turns off required MFA for the entire workspace, records the policy change in the audit log, and returns to the intended page. Authenticators that teammates already verified stay connected. Managers, Agents, and Viewers do not see or have permission to use this recovery action.

Require it for your whole team

Workspace Owners and Admins open Settings → Team → Two-factor authentication and turn on Require two-factor authentication. The setting is available on eligible plans and during an active trial.

What happens once it's on:

• Every existing member is bounced to the enrollment page the next time they load any Yesoma page. They can't access the inbox, settings, or anything else until they finish setup.
• New invitees get the same treatment on their first sign-in.
• No warning email is sent automatically, so give your team a heads-up before turning it on.

To turn the requirement back off, return to the same Team setting. If you are already blocked at enrollment, use the administrator recovery action there instead. Existing enrollments stay in place; people just stop being forced to set it up.

What sign-in looks like with 2FA on

Step	What you do
1	Enter email + password as usual.
2	Yesoma asks for a 6-digit code.
3	Open your authenticator app, type the code, hit Verify.
4	You're in. The next page load doesn't ask again for ~24 hours unless you sign out.

If you mistype the code, you get another shot — the codes regenerate every 30 seconds, so a fresh one is always seconds away.

Lost your authenticator app?

Phone got wiped, switched devices, or just can't find the app — you can't sign in anymore. Two paths:

• Self-recovery (if your workspace doesn't require MFA): Click "Forgot password" on the sign-in screen. The recovery link signs you in once and drops you on a screen where you can remove the bad factor at /security/mfa and enroll a fresh one.
• Email Yesoma support: Send a note to support@getyesoma.com from the email registered on your account. We can disable MFA on your account so you can sign in with just your password and re-enroll a new authenticator. We do this from the admin console; the action is recorded in the audit log.

If your workspace requires MFA, you'll be sent back to the enrollment page on your next sign-in to add a fresh factor.

Remove your authenticator

Go to /security/mfa → next to your authenticator, click Remove. You'll be signed back to password-only sign-in.

If your workspace requires MFA, removal kicks you to the enrollment page on the next request — you can't end up in a state where the workspace requires MFA but you don't have one.

Resetting your password

Forgot your password? On the sign-in page click Forgot password, type your email, and we'll send a recovery link via our own email pipeline. The link signs you in once and routes you to /reset-password so you can pick a new one.

If you already have 2FA on, the recovery link will ask for your 6-digit code before letting you change the password — this is intentional. A leaked email shouldn't be enough to reset your password if you've taken the trouble to enroll 2FA.

Why we built our own 2FA flow

Our enrollment + sign-in flows live inside Yesoma instead of a third-party widget so we can:

• Send recovery + setup emails through our own pipeline (not the rate-limited default), so they actually arrive.
• Show your workspace's required-MFA banner on the enrollment page so members know why they were sent there.
• Let Yesoma support help Workspace Owners when a member gets locked out, with every action recorded in the audit log.

Related

• Invite team members
• Billing and plan limits