MFA Setup and Recovery

Multi-factor authentication (MFA) means a second check on top of the first. This article explains where Serene Studio asks for it, how to set up an authenticator app, how backup codes work, and what to do if you are locked out.


Where the second step applies

How you sign in Second step
Passkey Built in. Every passkey sign-in asks for your PIN, fingerprint, or face.
Linked account (Microsoft, Google, LinkedIn, or GitHub) or sign-in link These count as a first step only. Serene Studio then asks for a passkey or for the six-digit code from your authenticator app.

A code sent to your email is not accepted as a second step.

If you have no second step yet

If you sign in with a linked account or a sign-in link and have neither a passkey nor an authenticator app, Serene Studio shows a page titled Set up a second sign-in step before it opens your workspace. It first asks you to save backup codes. Then choose one:

  • Set up a passkey, then follow the prompt from your browser or device.
  • Set up an authenticator app. Add the key shown on the page to your app, enter the six-digit code the app shows, and select Verify and continue.

Signing in with an authenticator code

  1. Finish the first step, with a linked account or a sign-in link.
  2. On the page titled Enter the 6-digit code from your authenticator app, type the code your app shows now.
  3. Select Continue.

If you have both a passkey and an authenticator app, the page is titled Finish signing in. Select Continue with passkey, or enter the code and select Continue with authenticator app.

An authenticator app shows a new code every 30 seconds, and each code works once. If you see that a code did not match or was already used, wait for the next code and try again. After too many wrong tries you are asked to wait a little while before trying again.

Your authenticator app in Settings

Go to Settings, then Privacy & Security, then Sign-in and passkeys. The Authenticator app entry shows whether one is set up on your account. If it is not, select Set up authenticator app and follow the steps. If it is, the entry shows the date it was added, and you can take it off by selecting Remove and confirming.


Backup codes

Backup codes are single-use codes that you create and keep. They are not a way to sign in by themselves. You enter one on the account recovery page, together with a second recovery check.

Creating a set

  1. Go to Settings, then Privacy & Security.
  2. Open Recovery codes.
  3. Select Generate backup codes.

You get a set of 10 codes. Select Download codes or copy them right away. They are shown once, and only a one-way scrambled form of each code is stored on our side, so we cannot show them to you again.

Treat backup codes like passwords:

  • Keep them in your password manager.
  • Do not leave a screenshot of them in your camera roll.
  • Do not email them to yourself.

Using a backup code

On the second-step page, select Can’t use your code? to open the Account recovery page. It asks for one backup code, a second recovery method, and a code for that method. Each backup code works once. If the page tells you the codes did not match, check both and try again.

The recovery page lists only the second methods your account has available. If it has none, the page tells you to contact your administrator or write to support@serenecreations.io.

Replacing your set

To replace your set, go back to Recovery codes and select Generate new codes. You are asked to confirm, because your current codes stop working as soon as the new set exists.


If you are locked out

If you cannot get past the sign-in prompt, for example because you have no passkey and cannot produce an authenticator code, use Can’t use your code? on the second-step page to open Account recovery, or contact us and we will help you recover access.


Next steps