Two-Factor Authentication (2FA) Security Guide
Two-Factor Authentication (2FA) adds an essential second layer of defense to your Flowa account. Even if your master password is compromised, an unauthorized party cannot access your projects, personal brain dump scratchpads, or workspace analytics without physical access to your authenticator token.
1. Supported Authenticator Applications
Flowa supports all RFC 6238 Time-based One-Time Password (TOTP) standards:
- Google Authenticator (iOS & Android)
- Authy (Multi-device sync)
- 1Password / Bitwarden / Apple Passwords (Integrated password managers)
- Microsoft Authenticator
2. Step-by-Step 2FA Activation
Setting up two-factor authentication takes less than 60 seconds:
- Open your workspace and click your profile picture to enter Settings.
- Select the Account & Security tab.
- In the Two-Factor Authentication section, click Enable 2FA.
- Flowa will display a secure QR code alongside a secret text key. Open your authenticator app and scan the QR code (or paste the text key).
- Enter the 6-digit verification code shown on your authenticator screen and click Confirm & Activate.
3. Emergency Backup Codes & Recovery
Immediately upon activating 2FA, Flowa generates a list of 10 single-use emergency backup codes:
Critical Storage Rules
- Download or Print Immediately: Store these codes in a secure password vault or physical safe.
- Single-Use: Each backup code can only be used once to bypass the authenticator requirement.
- Account Recovery: If your smartphone is lost, damaged, or wiped, backup codes are the only verified method to regain account access without contacting identity verification support.
4. Disabling or Regenerating 2FA
If you migrate to a new phone:
- Go to Settings > Account & Security.
- Click Regenerate Backup Codes if you have used several recovery keys.
- Click Disable 2FA, confirm with your current account password and a fresh 6-digit code, and re-enable it on your new device.
Frequently Asked Questions
Can I use SMS text messages for 2FA?
No. Due to known vulnerabilities in SMS routing (such as SIM-swapping and carrier interception), Flowa exclusively relies on cryptographically secure TOTP hardware and authenticator apps.
What happens if I lose both my phone and backup codes?
Contact privacy@flowa-app.tech from your registered email address. You will be required to complete identity and billing verification before account access can be safely restored.
