Account & safety
Two-factor authentication (2FA)
Require a 2FA authenticator app (or a backup code) after your password, so a stolen password is not enough to get in.
Two-factor authentication (2FA) adds a one-time code from an authenticator app after you enter your password. Letlink uses TOTP — the same standard as Google Authenticator, 1Password, Authy, and most password managers. It is off until you turn it on. Every plan includes it.
Turn it on
- Open Settings → Security.
- Choose Enable two-factor authentication.
- Scan the QR code in your authenticator app. If you cannot scan, type the manual setup key into the app instead.
- Enter the 6-digit code the app is showing, then confirm.
- Copy or write down the backup codes before you leave the page. Letlink stores only hashes of those codes — we cannot show the originals again.
Until you confirm a valid code, 2FA is not enabled. Canceling setup discards the unused secret.
Signing in
After a correct email and password, Letlink asks for an authentication code. Enter the current 6-digit number from the app, or one unused backup code (xxxx-xxxx). A used backup code will not work a second time.
If you started sign-in on the wrong account, choose Use a different account to sign out of the half-finished login and try again.
Backup codes
Setup creates ten codes. Each one signs you in once if the phone or app is gone. From Settings → Security, enter your current password and choose Regenerate backup codes to replace the set — previous codes stop working immediately. The page tells you how many unused codes remain.
Turn it off
On Settings → Security, enter your current password and choose Disable. You must already be signed in. Disabling clears the authenticator secret and any leftover backup codes.
If you are locked out
- Still have a backup code? Use it at the sign-in prompt, then regenerate a new set from Settings.
- Still have the authenticator? Sign in with a fresh 6-digit code, then disable or re-enroll from Settings if you are moving to a new phone.
- Lost both? Contact support from an email address already on the account. We will not turn 2FA off from an address we cannot match.
API tokens and apps
Workspace API tokens (REST, Zapier, n8n, MCP) authenticate on their own. They do not prompt for a TOTP code. Treat the token as a secret: regenerating it from Integrations invalidates every script still holding the old value.