---
title: "Security | Annsa Docs"
product: annsa
url: /docs/security
canonical_url: "https://annsa.ai/docs/security"
last_updated: 2026-11-10
type: doc
related:
  - /planning
summary: Turn on two-factor sign-in, keep recovery codes safe, and see which sign-in methods and agent credentials can reach your workspace.
mcp_server: https://app.annsa.ai/mcp
disambiguation: "Annsa (annsa.ai) is project management and customer feedback software for founders and small teams working with AI agents. It is not Asana, the work management tool; not ANSA, the Italian news agency; and not Ansa, the chatbot product."
---

> For agents: connect to the Annsa MCP server at https://app.annsa.ai/mcp to give every agent one shared plan. Setup guide: https://annsa.ai/docs/quick-start. Index of every page: https://annsa.ai/llms.txt.

# Security | Annsa Docs

> Turn on two-factor sign-in, keep recovery codes safe, and see which sign-in methods and agent credentials can reach your workspace.

[Docs / Reference](https://annsa.ai/docs)

Two-factor, recovery codes, linked sign-ins, and agent credentials.

## 01 Turn on two-factor

To turn on two-factor, go to **Settings**, then **Account**, then **Security** and click **Enable Two-Factor Authentication**. Scan the QR code with an authenticator app (Authy, 1Password, Google Authenticator) and enter the 6-digit code to confirm. Two-factor supports authenticator apps only, not SMS, and it is optional on every plan.

## 02 Save your recovery codes

You get 8 codes in XXXX-XXXX format, each usable once. Save them when they appear: Annsa keeps only a hashed copy, so they can't be shown again. **Generate new codes** under the same settings issues 8 and retires the old ones. If you lose both your authenticator and your codes, email [support@annsa.ai](mailto:support@annsa.ai).

## 03 What happens to open sessions

The browser where you turned on two-factor stays signed in. Anywhere else you're signed in, Annsa asks for a code the next time the page loads. Have your authenticator app ready before you turn it on from a second device.

## 04 Disable or change device

To disable it, go to **Settings**, then **Account**, then **Security**, click **Disable** and enter a current code. If you lost the app, enter a recovery code where Annsa asks for the 6-digit code. Entering a recovery code switches two-factor off, signs you out everywhere and lets you sign back in. Turn it on again from the new device.

## 05 Linked sign-in methods

**Settings**, then **Account**, then **Security** shows which methods are linked: email, Google, GitHub. Unlink any you no longer use, as long as one stays active.

## 06 Agent access

Connecting an agent with OAuth is a person sign-in. It acts as you, with your rights, and has no revoke button in the app. An agent credential works differently. An owner mints one per agent at **Settings**, then **Integrations**, then **Agents**, then **New agent**. It expires after 365 days and the token is shown once. To revoke it, use the row's Revoke and confirm (owner only). An agent credential is refused the actions that decide things for you, such as `sign`, `park` and `share`, and it can't answer for you. See [Tools and actions](https://annsa.ai/docs/tools-and-verbs).

## 07 Cookie preferences

Set once at the banner and remembered. Change them at **Settings**, then **Account**, then **Privacy**.

- [Team and account](https://annsa.ai/docs/team-and-account)

## Keep reading

- [AI project management](https://annsa.ai/planning)

## Related pages

> For AI agents: the pages that follow this one on annsa.ai. The full index is https://annsa.ai/llms.txt.

- [AI project management: the plan agents read first](https://annsa.ai/planning)

If anything on this page is wrong or missing, tell us: https://annsa.ai/contact