How to turn it on
Account → Security → "Enable 2FA". Pick: (1) authenticator app like Google Authenticator (TOTP), or (2) WebAuthn (fingerprint, Face ID, hardware key).
When you'll be asked
Every new device login. Existing sessions stay valid for 7 days. Magic-link login skips 2FA (the email is already proof).
If you lose your 2FA device, contact support — we'll verify your identity and reset it within 24 hours.