Password, two-factor authentication and passkeys
Password, two-factor authentication and passkeys in Beyond.
Open Settings → Security. Account protection is available on every plan and does not depend on your workspace role.
Password
Enter your current and new passwords and confirm the change. Other app sessions end while your current session stays open. Ordinary password changes preserve MCP connections; revoke those separately in Integrations. If you were issued a temporary password, Beyond requires changing it before normal work.
Two-factor authentication
Start setup, add the secret to an authenticator app using its QR code or manual key, and enter a six-digit code. After enabling protection, save the 10 recovery codes: they appear once and each works once.
When signing in with a password, the second step accepts an authenticator code or recovery code. Security settings actions require a current authenticator code; a recovery code cannot replace it there. Generating a new recovery set immediately invalidates the old set. Disabling protection requires your password and code. Five consecutive incorrect codes lock code checks for 15 minutes; wait for the lock to expire.
Passkeys
Select Add passkey, give it a recognizable name, confirm your password and follow the browser or device prompt. You can then sign in using a fingerprint, face or device PIN. A device-verified passkey does not require an additional TOTP code. You can hold up to 10 passkeys, rename them and remove them. Use password sign-in if your browser does not support passkeys.
Delete your account
In Account, open deletion, review your owned workspaces and confirm your current password. A 30-day recovery period begins, and app sessions, MCP access and support access are revoked. To recover, sign in using your existing method and cancel deletion before the deadline, then sign in again. Recovery is unavailable after the deadline even if cleanup has not finished.
Employees retain their personal accounts. Workspaces owned by the deleting account become read-only for them; still-owned workspaces are eventually removed with the account. Save a backup or transfer ownership first.