Configure team security

Control how your team signs in to the admin dashboard. This article covers sign-in methods, two-factor authentication (2FA), recovery codes, and the audit log, a tamper-evident record of every security-sensitive change.

Note: For how customers sign in to your portal, see Control portal access and sign-in.

Where to find it

Go to Admin > Settings > Access & Security. Team security lives on two tabs:

• Sign-in: sign-in methods, the 2FA requirement, single sign-on, and recovery codes.
• Audit log: the record of security-sensitive changes.

By default, Owners and Admins can open this page.

Sign-in methods

The Sign-in tab lists every way people can sign in. Each toggle applies to both the team sign-in form and the portal sign-in form.

Note: Team invitations and recovery-code sign-in always use an emailed link, even when the magic-link toggle is off. The toggle only controls whether magic link appears on the sign-in form.

Two-factor authentication

Two-factor authentication adds a 6-digit code from an authenticator app on top of a password. It doesn't apply to SSO sign-ins: with SSO, multi-factor authentication is handled by your identity provider.

Set up 2FA for your account

Each person enrolls themselves:

1. Open your account settings (your Profile page) and find Two-factor authentication.
2. Click Set up authenticator and confirm your password.
3. Scan the QR code with any authenticator app, such as Google Authenticator, 1Password, or Authy.
4. Enter the 6-digit code to verify.
5. Save the backup codes shown. Each one works once if you lose your authenticator.

To turn it off, click Disable two-factor and confirm your password.

Require 2FA for your team

Turn on Require two-factor authentication on the Sign-in tab to enforce it for the whole team:

• Every team member must enter an authenticator code after each password sign-in.
• Team members who haven't enrolled yet are asked to set up 2FA during a password sign-in, before they can continue.
• Magic-link, social, and email-OTP sign-ins don't ask for an authenticator code. Only password sign-in is covered by the requirement.

Note: Requiring 2FA needs Password sign-in turned on, because setting up an authenticator requires confirming a password.

Reset a member's 2FA

If a team member loses both their authenticator and their backup codes, an admin can clear their enrollment:

1. Go to Admin > Settings > Members & Teams.
2. Click the ... menu on the member's row.
3. Choose Reset two-factor and confirm.

If Require two-factor authentication is on, the member is asked to enroll again on their next password sign-in. Otherwise they can set 2FA up again from their Profile page. The reset is recorded in the audit log.

Recovery codes

Recovery codes are break-glass passcodes for signing in when SSO is unavailable. You generate and manage them alongside single sign-on on the Sign-in tab. See Set up single sign-on.

Audit log

The audit log is an append-only record of security-sensitive admin actions. Open Admin > Settings > Access & Security and choose the Audit log tab.

Note: On Quackback Cloud, the audit log is available on the Enterprise plan.

It records:

• Authentication: successful and failed sign-ins, new-device sign-ins, rate-limited attempts, and sign-in method changes.
• SSO: connection changes, per-domain enforcement, and recovery-code generation and use.
• Team: role changes (including changes made by SSO role mapping), 2FA resets, and bulk session sign-outs.
• Portal access: visibility changes, allowed-domain and allowed-segment edits, the widget sign-in toggle, and visitors who were signed in but refused at the portal.
• Portal invites: sends, resends, accepts, revokes, copied links, and expirations.
• Boards: changes to a board's access settings (view, vote, comment, and submit, plus segment allowlists).
• Moderation: workspace moderation default changes, plus approve, reject, and hold actions on posts and comments.
• Widget activity: widget-to-portal handoffs, both successful and rejected. Successful handoffs are hidden in the All events view by default to keep noise down. Rejected handoffs stay visible. Filter for widget activity when you're debugging a handoff.

Each entry records who acted, their IP address and user agent, a request id, the type of actor (user, service, API key, anonymous, system, or support), and the sign-in method they used. Filter by actor, event type, or time range, and export the filtered view as CSV for investigations or compliance.

Tip: Check the audit log after any access change, such as a new admin, a removed member, an SSO change, or a portal access edit. It's the fastest way to confirm who did what.

Sign-in hardening

Quackback rate-limits password and magic-link sign-in attempts per combination of IP address and email address. Attempts from one IP address are also capped across all emails.

Quackback also tracks the devices an account signs in from. When an account signs in from a device it hasn't seen before, the account owner gets an email. The first device an account uses doesn't trigger one.

Signing in through the widget, or opening the portal from the widget, never unlocks admin tools, even after you invite that person to your team. See How sign-in works.

Related articles

• Set up single sign-on
• Control portal access and sign-in
• Manage your team
• How sign-in works