Mocco

Two-step verification

With two-step verification on, signing in to Mocco takes your password and then a 6-digit code from an authenticator app on your phone. Someone who learns your password still can't sign in without the phone. It is off until you turn it on, and it applies to your own sign-in in every workspace you belong to.

Turn it on

  1. Open the account menu (your initial, top right), choose Account settings and find Two-step verification.

  2. Click Turn on and enter your password.

  3. Scan the QR code with an authenticator app such as 1Password, Google Authenticator or Authy. If you can't scan it, type the setup key shown under it instead.

  4. Enter the 6-digit code the app shows and click Confirm and turn on. Until this code is accepted, nothing about your sign-in changes.

  5. Save your backup codes: copy them or download them as a text file, then click I've saved them. Mocco shows them only this once.

Signing in

After your password, Mocco asks for the code from your authenticator app. If you don't have your phone, switch to Backup code and enter one of your backup codes; each one works once.

Tick Trust this browser for 30 days to skip the code on this browser for 30 days. Use it only on your own computer.

If you were signing in to connect an app, such as an AI agent over MCP or Mocco Notes, the connection continues after the code exactly as it would after a password.

Wrong codes are limited: after several in a row, sign in again, and after more, the code step is locked for a while.

Backup codes

You get 10 backup codes. To replace them, for example after using a few or if you think someone saw them, click New backup codes on the Account settings page and enter your password. The old codes stop working at once.

Turn it off

Click Turn off on the Account settings page and enter your password. Your next sign-in asks for the password only.

Require it for your workspace

An owner can require two-step verification of everyone in a workspace. Open Settings, find Two-step verification and click Require two-step verification. You need it on for your own account first; until then the button is off and links to your account settings. Admins and members see whether it's required but can't change it.

While it's required, a member without two-step verification can still sign in, but this workspace shows Turn on two-step verification to continue with a link to their account settings. AI agents (MCP) and Mocco Work are refused in this workspace too. Once they turn it on and come back, everything works again. Their other workspaces aren't affected, and API keys keep working.

Owners and admins see who has it on in Members (Two-step on or Two-step off next to each person). Turning the requirement on or off is recorded in the workspace's audit log.

To stop requiring it, click Stop requiring it in the same place.

What your workspaces see

Turning it on or off, replacing backup codes and signing in with a backup code each add an entry to the audit log of every workspace you belong to (account.two_factor.*). The entry names you and what happened, never a code.

Agents can read whether two-step verification is on for you (mocco_account_get), but they can't turn it on or off or see your codes: those stay on the Account settings page.