Secure your personal access
Your account's Security page brings together your password, two-factor authentication and active sessions. Available controls depend on how you sign in and your organizations' security requirements.
Open this page from your avatar: Account settings → Security. You do not need to administer an organization to manage your own account.
Enable two-factor authentication
With two-factor authentication, signing in with your password also requires a six-digit code from an authenticator application. Prepare that application before starting.
- In Security, find Two-factor authentication and select Activate.
- Enter your current Boldo password and select Continue.
- Scan the displayed QR code with your authenticator application. Alternatively, enter the displayed setup key in that application.
- Enter the current six-digit code from the authenticator in Boldo.
- Select Enable and check that two-factor authentication is active.
Scanning the QR code alone does not finish activation. Complete the code-validation step before leaving the dialog. Keep your setup key, QR code and verification codes private.
On your next password sign-in, enter the code from the authenticator when Boldo requests it. If a code is rejected, use a newly generated code and check that the authenticator's device has the correct time.
When Boldo requires configuration
An organization can require two-factor authentication before you access its content. Boldo may also require you to configure it again.
In that configuration flow, first enter the verification code sent to your email address. Use Resend code when available if necessary. Then configure your authenticator and validate its code as described above.
The email code verifies access to your mailbox during setup. It does not replace the authenticator code used for subsequent password sign-ins.
When you sign in through SSO
For an SSO session, Boldo indicates that authentication is managed through your organization's identity provider. The local two-factor activation control is not offered for that session. Follow your organization's SSO instructions for its second factor.
A missing local activation button therefore does not mean that your organization has no second-factor protection. See organization security and SSO for administration settings.
Disable two-factor authentication
If Unenroll is available in the two-factor section, select it, confirm your password and complete the confirmation. Disabling it does not remove an organization's requirement: you may have to configure it again before accessing that organization.
If you have lost access to your authenticator, contact support for recovery assistance. Do not send your password, setup key or QR code. Resetting a password is not a documented replacement for recovering a second factor.
Change your password
The password section appears when your account has an email-and-password sign-in method. Accounts that only use SSO manage their credentials with the identity provider.
- In Security, select Change password.
- Enter Current password.
- Enter New password, then repeat it in Confirm new password.
- Select Change my password.
- Wait for confirmation before closing the dialog.
The new password must contain 12–50 characters, including a lowercase letter, an uppercase letter, a number and a special character. Spaces are not accepted.
A successful change signs out your other sessions while keeping the current device signed in. If you do not know your current password, use the password-reset flow instead of repeatedly submitting the form.
Review and end active sessions
Active sessions lists your connected devices with their browser, last activity and IP address when available. This device identifies the session you are using.
- Find the other device you want to disconnect.
- Select Sign out on its row.
- Read the confirmation and select Sign out again.
That device must sign in again to use your account. To disconnect all the other listed sessions, use Sign out others and confirm. These controls preserve your current session and do not delete your account.
The Session duration section explains the lifetime applied to your session. It follows the strictest policy among the organizations accessible with that session. It is not a personal duration you can extend here.
Review connected applications
When available, Connected apps lists clients you authorized to access Boldo through MCP. These authorizations are distinct from browser sessions and API keys.
Use the MCP connection and revocation procedure to remove an application's access for a particular organization. Signing out a browser session is not the same action as revoking a client.