Two-factor sign-in, and a way to require it for your whole studio

A Tombstack account opens your crash reports, player identifiers and bug reports. A password alone is a thin lock for that, and larger studios told us so: they wanted a second factor, and a way to make sure every person on the team uses it. Both are live today.

Turn it on in a minute

Two-factor works with any authenticator app that makes standard 6-digit codes that change every 30 seconds. Any user can turn it on, with no plan change.

1. Open the Account page and choose Turn on under two-factor sign-in.
2. Scan the QR code with your authenticator app.
3. Confirm with a code from the app.
4. Save your recovery codes. You get 10 single-use codes, shown once. Copy them or download them, and keep them somewhere other than your phone.

From then on, every password sign-in also asks for a code from your app, or one of your recovery codes. That holds on the web and in the Unity editor sign-in. Turning two-factor on signs out the account's other browser sessions and editor sign-ins, so a session opened before the change cannot outlive it. We email you when two-factor is turned on or off, so a change you did not make does not go unnoticed.

If something goes wrong

• Lost your phone: sign in with a recovery code, then set two-factor up again from Account.
• Lost both: contact support. After a human identity check, we can reset two-factor on the account.
• Wrong codes: too many wrong codes pause code entry for a while and email the account. Nothing is deleted.

Require it for everyone in a studio

On the team page, studio owners can switch on Require two-factor for everyone. The owner must have two-factor on first, so the person flipping the switch is never the one locked out.

Members who do not have it yet keep their account and can always open their Account page, but they cannot open that studio's games or data until they turn two-factor on. Nobody is removed from the team and nothing is lost; the studio's data stays closed until the member has the second factor in place.

Unity editor: read this before you turn it on

Limits

• Codes come from an authenticator app.
• Recovery codes are shown once, so store them when you see them.
• Editor sign-in with two-factor needs the next Unity package release, as above.

To see everything that shipped, read the changelog; the rest of the product is in the docs.