Two-step verification asks for a code from a second device after your password, so that a leaked password is not enough to reach your account on its own. It is set per account rather than per organisation: turning it on protects your own sign-in, and every organisation you belong to.
Security options live in the account portal at account.surrealdb.com/security, under Security settings. Studio does not manage them.
If you sign in with Google or GitHub, two-factor authentication configured with that provider already applies to your SurrealDB account, because the provider verifies you before returning you to SurrealDB. Adding an authenticator app here covers accounts that sign in with an email address and password. See Accounts and sign-in.
Add an authenticator app
An authenticator app generates a new six-digit code every thirty seconds, with no network connection needed. Any TOTP app works, including 1Password, Bitwarden, Google Authenticator and Authy.
Under Set up a new security option, choose Authenticator app.
Scan the QR code with your authenticator app. Where a camera is not available, use the Manual setup code shown beside it and enter the key by hand.
Enter the code your app displays to confirm the pairing.
The method appears under Two-step verification once it is confirmed. From then on, signing in asks for a code after your password.
One authenticator app can be registered per account. To move to a different app or device, remove the existing method first and add the new one.
Save your recovery code
Setting up your first method produces a single recovery code. It signs you in if your authenticator app is ever unavailable, so store it somewhere you can reach without that device: a password manager, or somewhere safe offline.
The code is shown once. Copy it before selecting I have safely recorded this code, because it cannot be displayed again afterwards.
Losing both your authenticator app and your recovery code locks you out of the account. Neither can be recovered by SurrealDB. Save the recovery code somewhere separate from the device running the app, so that losing one device does not cost you both.
Remove a method
Each registered method can be removed from the same page. Removing your only method returns the account to password-only sign-in, so add a replacement first if you intend to keep two-step verification on.
Next steps
Invite colleagues so each person signs in with their own account and their own second factor.
Create a token for automation rather than sharing an interactive account.