Configure team security

Control how your team signs in to the admin dashboard. This article covers sign-in methods, two-factor authentication (2FA), recovery codes, and the audit log, a tamper-evident record of every security-sensitive change.

Note: For how customers sign in to your portal, see Control portal access and sign-in.

Where to find it

Go to Admin > Settings > Access & Security. Team security lives on two tabs:

• Sign-in: sign-in methods, the 2FA requirement, single sign-on, and recovery codes.
• Audit log: the record of security-sensitive changes.

By default, Owners and Admins can open this page.

Sign-in methods

The Sign-in tab lists every way people can sign in. Each toggle applies to both the team sign-in form and the portal sign-in form.

Note: Team invitations and recovery-code sign-in always use an emailed link, even when the magic-link toggle is off. The toggle only controls whether magic link appears on the sign-in form.

Two-factor authentication

Two-factor authentication adds a 6-digit code from an authenticator app on top of a password. It doesn't apply to SSO sign-ins: with SSO, multi-factor authentication is handled by your identity provider.

Set up 2FA for your account

Each person enrolls themselves:

1. Open your account settings (your Profile page) and find Two-factor authentication.
2. Click Set up authenticator and confirm your password.
3. Scan the QR code with any authenticator app, such as Google Authenticator, 1Password, or Authy.
4. Enter the 6-digit code to verify.
5. Save the backup codes shown. Each one works once if you lose your authenticator.

To turn it off, click Disable two-factor and confirm your password.

Require 2FA for your team

Turn on Require two-factor authentication on the Sign-in tab to enforce it for the whole team:

• Every team member must enter an authenticator code after each password sign-in.
• Magic-link sign-in is refused for anyone who has enrolled. They must use password plus code.
• Team members who haven't enrolled yet are asked to set up 2FA before they can continue.

Note: Requiring 2FA needs Password sign-in turned on, because setting up an authenticator requires confirming a password.

Reset a member's 2FA

If a team member loses both their authenticator and their backup codes, an admin can clear their enrollment:

1. Go to Admin > Settings > Members & Teams.
2. Click the ... menu on the member's row.
3. Choose Reset two-factor and confirm.

The member enrolls again on their next sign-in. The reset is recorded in the audit log.

Recovery codes

Recovery codes are break-glass passcodes for signing in when SSO is unavailable. You generate and manage them alongside single sign-on on the Sign-in tab. See Set up single sign-on.

Audit log

The audit log is an append-only record of security-sensitive admin actions. Open Admin > Settings > Access & Security and choose the Audit log tab.

Note: On Quackback Cloud, the audit log is available on the Enterprise plan.

It records:

• Authentication: successful and failed sign-ins, new-device sign-ins, rate-limited attempts, and sign-in method changes.
• SSO: connection changes, per-domain enforcement, and recovery-code generation and use.
• Team: role changes (including changes made by SSO role mapping), 2FA resets, and bulk session sign-outs.
• Portal access: visibility changes, allowed-domain and allowed-segment edits, the widget sign-in toggle, and visitors who were signed in but refused at the portal.
• Portal invites: sends, resends, accepts, revokes, copied links, and expirations.
• Boards: changes to a board's access settings (view, vote, comment, and submit, plus segment allowlists).
• Moderation: workspace moderation default changes, plus approve, reject, and hold actions on posts and comments.
• Widget activity: widget-to-portal handoffs that succeeded or were rejected. This group is hidden by default to keep noise down. Turn it on when you're debugging a handoff.

Each entry records who acted, their IP address and user agent, a request id, the type of actor (user, service, API key, anonymous, or system), and the sign-in method they used. Filter by actor, event type, or time range, and export the filtered view as CSV for investigations or compliance.

Tip: Check the audit log after any access change, such as a new admin, a removed member, an SSO change, or a portal access edit. It's the fastest way to confirm who did what.

Sign-in hardening

Quackback rate-limits password and magic-link sign-in attempts per IP address and email address. It also tracks devices and emails the account owner the first time an account signs in from a new device.

Signing in through the widget, or opening the portal from the widget, never unlocks admin tools, even after you invite that person to your team. See How sign-in works.

Related articles

• Set up single sign-on
• Control portal access and sign-in
• Manage your team
• How sign-in works