2FA
Authenticator-firstUse a real authenticator app and store recovery codes safely.
Account
Security and 2FA
Security in opheli.ai means protecting account access, provider credentials, attached context, and support boundaries. Two-factor authentication helps protect the account layer even if a password is exposed.
Guide summary
Use this page to understand the surface before you act inside it.
Protect your account, provider keys, and recovery posture with two-factor authentication and good credential hygiene.
Guide type
AccountThis guide reflects the current product workflow and surface ownership.
Sections
7Summary first, then steps, mistakes, and recovery notes.
Related guides
3Written against the current product structure and core execution workflow.
Provider keys
Encrypted at restThe product should not expose provider secrets back to the browser.
Related action
Review support boundariesSupport should not receive your credentials or hidden runtime secrets.
Guide section
What it is
Security and 2FA cover account access, credential posture, recovery options, and safe product behavior.
When to use it
Use it during account setup, after a security concern, or before connecting real provider credentials.
Where to find it
Find it in Security / 2FA, Provider Vault, and account settings.
What happens next
You use this surface as part of the broader mission -> task -> run -> artifact workflow.
Common mistake
Skipping recovery code storage
Related action
Open Contact Support only after removing secrets from the message body.
Guide section
Why it matters
Provider-backed execution and user-owned context deserve stronger access protection than a password alone.
Guide section
How it fits into the workflow
Security posture sits beneath every other product action. Weak access hygiene can compromise the whole execution environment.
Guide section
Step-by-step usage
- Enable 2FA with an authenticator app.
- Store recovery codes outside the product.
- Review provider credential posture in Provider Vault.
- Avoid uploading or messaging secrets into the wrong surfaces.
- Use support only with safe context, never by pasting keys or tokens.
Guide section
Inputs and outputs
Inputs needed
Authenticator app
Secure recovery-code storage
Clean provider credential hygiene
Outputs produced
Better account protection
Safer provider posture
Cleaner recovery path if a password is lost
Guide section
Common mistakes
- Skipping recovery code storage
- Treating support as a place to paste secrets
- Reusing weak credentials across environments
Guide section
Troubleshooting
If 2FA or recovery feels blocked, use the documented account recovery path rather than disabling security posture casually.