Skip to main content

Two-Factor Authentication

Two-factor authentication (2FA) adds a second step to sign-in: after your password, you also enter a time-based one-time code from an authenticator app. Signing in to the Kvery web app then needs the code as well, except in a browser you chose to remember. API calls with Basic Auth don't ask for it (see 2FA and API access).

How it works​

Kvery uses TOTP (the standard behind apps like Google Authenticator, 1Password and Authy). When you enable 2FA, Kvery shows you a setup image — a QR code — that you scan with your authenticator app. The app then generates a fresh 6-digit code every 30 seconds.

Enabling 2FA​

  1. Go to your profile and start the 2FA setup.
  2. Kvery displays the setup image (QR code).
  3. Scan it with your authenticator app.
  4. Enter the current code from the app to verify and turn 2FA on.

From then on, each login asks for your password and then a current code, except in a browser you chose to remember (see Remembering a browser).

Signing in with 2FA​

After entering your password, Kvery prompts for the 6-digit code. Open your authenticator app, read the current code for Kvery, and enter it.

Remembering a browser​

When you enter the code, you can tick Remember this browser. Kvery then skips the code in that browser for 30 days — you still sign in with your password. Only that browser is remembered (it gets a random token in a cookie); other browsers and devices keep asking for the code, and a remembered browser of someone else never counts for your account.

Kvery forgets all of your remembered browsers when you change your password (on the profile or with the Forgot password flow) and when you turn 2FA on or off. Clearing the browser's cookies forgets that browser too.

Disabling 2FA​

You can turn 2FA off from your profile if you need to; Kvery asks for a current code to confirm. Do so only if you're sure — disabling it removes the second layer of protection.

Password reset and 2FA​

Resetting your password with the Forgot password flow turns 2FA off for your account, so you can sign in again even if you can no longer generate codes. After signing in, turn 2FA back on from your profile.

tip

Keep a backup of your authenticator (most apps support secure backup or multi-device sync) so you don't lose access if you change phones.

2FA and API access​

The 2FA code is asked for when you sign in to Kvery. API calls with Basic Auth — your e-mail address and password, sent with every request — do not ask for it. Basic Auth also has the full access of your account and cannot be limited with scope tags, made read-only or set to hide the SQL. For scripts, integrations and AI assistants, use MCP tokens instead: they can be scoped, made read-only, set to hide the SQL of your queries, and revoked at any time.

Tips​

  • Pair 2FA with a strong, unique password for the best protection.
  • For shared API access, prefer scoped tokens — for example MCP tokens — over sharing account credentials.