Account security and two-factor authentication
Personal security is under My Account (/settings/account), below Change Password. Organization-wide security is under Settings (/settings#organization-security). These are different scopes: the organization controls its policy, and each user chooses an available verification method. Availability and enforcement depend on the organization's current policy and rollout state; do not infer the active policy from a different user's account.
Email codes and authenticator setup
The available methods are email verification codes and an authenticator app. Email codes are six digits. Use the most recently requested code and the same signed-in browser session; a resend can invalidate an older code. Never ask a user to paste a verification code, password, QR code, setup secret, recovery token, or API key into support chat.
Use Enable 2FA Email or Send 2FA Email Code as displayed. Authenticator enrollment starts with Set up authenticator app. Follow the email-verification step when requested, then use the enrollment QR code or manual setup key in an authenticator such as Google Authenticator. Enrollment must be confirmed with an authenticator code before switching protection. Starting enrollment is not the same as completing it. If no QR or setup key appears, report the setup failure; do not tell the user that the authenticator is ready.
Access problems
An organization requiring two-factor authentication can prevent members from turning off their own protection. Do not suggest disabling the organization's security to bypass a login problem. If a correct, recent code is rejected, request the exact non-secret error wording and whether it was email verification or an authenticator. Repeated requests can hit rate limits. Respect a displayed cooldown; do not promise a particular wait time without evidence.
Team access and permissions
Team membership is managed under Settings → Team (/settings/team). Owners, admins, admin-limited members, and staff have different permissions. Staff access can also depend on assigned permissions. A missing menu item may be a permission restriction rather than a bug. Do not promise access to billing, integrations, prices, client contacts, contracts, or reports without checking the signed-in user's role. Support chat cannot grant access or change a member's role.