Two-factor authentication and account security

Two-factor authentication adds a code from an authenticator app to every sign-in, so a stolen password alone cannot open your account. You choose whether to turn it on, and every part of MailGlo works either way, unless an account's owner requires it for everyone.

With it on, MailGlo asks for the code each time you sign in and when you reset your password. Once you are signed in, nothing asks for it again.

Turn it on

1. Open Settings, Security, and choose Set up an authenticator.
2. Add the secret to your authenticator app.
3. Enter the six-digit code to confirm. Your next sign-in asks for a code.

Require it for everyone

An owner can require two-factor authentication for the whole account under Settings, Security. While it is on:

• A person opens the account only from a sign-in that used their code. Someone who has not set it up is asked to before anything else, and their other accounts stay open.
• A personal API token or AI client works while its person has two-factor authentication on.
• Agents keep their own tokens and permissions.

You turn it on from a sign-in that used your code, so it never locks you out. The setting shows how many people have not set it up yet. Turning it off leaves everyone's own two-factor authentication on.

Single sign-on

People can sign in through your organization's identity provider, with OpenID Connect or SAML 2.0. An owner sets it up under Settings, Security:

1. Add your email domain and publish the TXT record MailGlo shows, then check it. One organization at a time proves a domain.
2. Choose how your provider signs people in. For OpenID Connect, register MailGlo with the redirect URI shown and enter the issuer, client ID and client secret. For SAML, add MailGlo with the entity ID and reply URL shown, then paste your provider's metadata.
3. Choose the role people join with: Viewer or Administrator.

People then sign in with Use single sign-on on the sign-in page and their work address. Someone new joins with the role you chose, within your plan's users. A sign-in through single sign-on opens your organization only. Unless you require single sign-on, people who have two-factor authentication on, or who also belong to another MailGlo organization, sign in with their password.

Require it. Once it is on and a domain is proved, an owner can require single sign-on for people at your domains. They then open your organization only through it. Owners can still sign in with their password and code, so you are never locked out, and everyone's API tokens, AI clients and agents keep working. A sign-in through your single sign-on also meets your organization's two-factor requirement, since your provider applies its own.

Sessions and tokens

Settings lists your signed-in sessions; sign out any you do not recognize. Personal API tokens let your own scripts act as you. For an AI agent, connect it under Agents in Settings instead, so it has its own identity, permissions and limits.

Losing your authenticator

A reset waits a safety period before it completes, and owners are told, so it can be cancelled if you did not ask for it. In an account that requires two-factor authentication, you set it up again before you can open that account.