Security
Turn on two-step sign-in, add passkeys, link Google, GitHub or Apple, manage where you are signed in, and change your email or password.
Settings › Security gathers the ways into your account: Two-step sign-in, Sign-in methods, Passkeys and Signed in. Owners and admins also find Workspace sign-ins. This page shows you how to protect your account, see where you are signed in, and change your sign-in email or password.
Before you start
- Open Governance › Settings › Security.
- When you add a way in, such as a passkey, two-step sign-in or a linked account, you first confirm it's you with your password, and a code when two-step sign-in is on. Each change is mailed to you.
- If your account has no password yet, set one first with Forgot password on the sign-in page.
Turn on two-step sign-in
Two-step sign-in adds a code from an authenticator app, such as Microsoft Authenticator, 1Password, Authy or Google Authenticator, at every sign-in.
In Two-step sign-in, click Turn on.
Type Your password, and a code if asked, then click Continue.
Scan the QR code with your authenticator app.
The app starts producing 6-digit codes for Nexa Agora. If you can't scan, click Can't scan? Show the secret.
Type the 6-digit code the app shows, and click Verify.
Save the recovery codes now.
They are shown once. Each one works one time, and one code signs you in if you lose your device.
Click I've saved them.
The card reads Two-step sign-in is on.
Turn off two-step sign-in
Click Turn off two-step sign-in.
Type your Password and an Authenticator or recovery code.
Click Turn off, or Keep it on.
Turning it off does not reset an admin's grace period.
Add a passkey
A passkey lets you sign in with your device, such as Face ID, Touch ID, Windows Hello or a security key, without a password.
In Passkeys, click Add a passkey.
Confirm it's you, click Continue, then follow your device's prompt.
Each passkey shows when it was added and last used, and Synced when it is synced. To remove one, click Remove, then Remove — sure?.
On the sign-in page, click Sign in with a passkey to sign in without a password. A passkey can also answer the second step of a password sign-in.
Link Google, GitHub or Apple
In Sign-in methods, click Link next to the provider. Only the providers your Nexa Agora offers are listed.
Confirm it's you, then click Continue to ….
Back on Security, you see that the account is linked and you can sign in with it.
To unlink an account, click Remove. You can never remove the only way into your account: set a password or link another account first.
See where you are signed in
Signed in lists every browser, the mobile app and each external agent's connection, labeled External agent with its name. This device is marked.
- Click Sign out to end one session.
- Click Sign out everywhere else, then confirm, to end all the others. This device stays signed in.
Change your sign-in email
Open Settings › Profile. In Sign-in, next to your email, click Change email.
Type the New email and Your password, and the code when two-step sign-in is on.
Click Send the link.
A confirmation link goes to the new address. Your current address can undo the change for 72 hours.
Open the link and click Confirm the change.
You see Email changed. From now on, you sign in with the new address.
To cancel before confirming, click Cancel the change on the row.
If you did not ask for the change, the email sent to your old address leads to Stop the email change. Click Stop the change. To keep the account safe, this also closes every session and removes the password, passkeys and linked sign-ins. You then set a new password from the link sent to that address.
Reset a forgotten password
There is no password change on Security. A forgotten or changed password goes through Forgot password? on the sign-in page.
On the sign-in page, click Forgot password?.
Type your Email and click Send reset link.
Open the link on the same device.
Type a New password, at least 8 characters, and Confirm password. Click Reset password.
You see Password updated.
A reset removes the ways in that were never confirmed with your password, added before 14 October 2026, and lists them. Sign in with your new password, then add them again from Settings › Security.
Read the workspace's sign-ins
This is for owners and admins.
Open Workspace sign-ins.
Filter with All, Sign-ins, Refused, Security changes or Invites.
Each row names the person and the event, for example Signed in · with two-step, Wrong password, Locked out after repeated failures or Added a passkey.
Click Show older to read further back.
The list covers the workspace's people only. The address of an invitation is never shown.
What you will see
Good to know
- Recovery codes are shown once, and each works one time.
- If the two-step step waits more than five minutes, the sign-in expires. Enter the password again rather than spending another recovery code.
- Every change to a way in is mailed to you.
- Every member manages their own two-step sign-in, passkeys, linked accounts, sessions, email and password.
- No external assistant can touch passkeys, two-step sign-in or account recovery, whatever it is allowed.