The second step

Only the ways your account has are offered. If a way you expected is missing, use Use a different email to start again, or see Sign-in errors and what they mean.

Two more ways exist as optional extra steps and have their own page: Use my password and Email me a code. See Optional extra steps. A third, Email me a code instead, is for a person who lost the only passkey they have; see If you lost your passkey.

1. Code from your authenticator app, the way the screen starts.
2. Use a passkey, under Other ways to confirm.
3. Use a recovery code.
4. Continue with my password only (limited session).

When the screen asks for the second step because the sign-in looks unusual, it also offers Continue with my password only (limited session). It says This sign-in looks unusual, for example from a new browser or place, so you are asked for more than your password. Select the button and you are signed in with your password alone. The session is limited:

• it is at the lower assurance level (AAL1). An application that asks for two factors in its sign-in request (acr_values) still has them asked for and does not accept this session; an application that does not ask accepts it at AAL1;
• the new-sign-in alert email is always sent, and Keep me signed in on this device does not apply;
• it cannot change how you sign in, create tokens, export or delete your data. Each of these shows Confirm it is you instead of a bare refusal, and once you confirm with your passkey or authenticator app the session can do them. The screen says A limited session cannot change how you sign in, create tokens, export or delete your data until you confirm it is you with a second factor. We email you about this sign-in.

The button is not offered when the application or your organization requires two factors, or when the platform judges the sign-in too risky: that sign-in is refused.

A recovery code is one of a set you receive when you turn on an authenticator app. Each one works once, so a code you have used is gone. Keep them somewhere safe, apart from the device that holds your authenticator app. You create a new set in your account, and creating one stops the old codes working. See Security and passkeys.

Some sign-ins need a stronger confirmation than usual. In that case the screen may offer only Use a passkey and no code, because a six digit code would not be enough. Use the passkey, or start the sign-in again on a device that has one.

When your passkey is the only second step on the account and you can no longer reach it, the screen can offer an emailed code instead. It is offered only after a correct password, and only when all of these hold:

• the passkey is your only second step (an account with an authenticator app keeps the authenticator app and its recovery codes instead);
• the sign-in does not ask for more than that, for example because the application or your organization requires a stronger level;
• your organization allows a password followed by an emailed code;
• the account has a verified email address to send to.

Where the platform has turned the option on and these hold, the screen still starts with Use a passkey, and Other ways to confirm lists Email me a code instead. Under the buttons, the link I lost my passkey opens account recovery with the address you typed filled in. It is shown only together with this offer.

If no email arrives, the row Nothing arrived? has a button that counts down as Send again in a clock, then becomes Send again. The number of codes sent for an account is limited. Beyond that the page refuses the request and says how long to wait.

After an emailed link or code#

A person who started with an emailed link or code has already proved the mailbox, so the screen asks for the password instead of a second emailed code. Where the same conditions hold (the passkey is the only second step, the account has a password, the organization allows an emailed link followed by a password, and the platform has the option on), the screen still starts with Use a passkey, and Other ways to confirm lists Use my password instead. It says Lost your passkey? Type your password to finish signing in., with the same one level lower note and the I lost my passkey link. The same limits apply to the session it opens.

One level lower#

The screen says This sign-in is one level lower than a passkey, and some apps will still ask for your passkey. Your other addresses are told when you use it. A sign-in with a password and an emailed code is at the lower assurance level (AAL1, the password and email proofs), and it can never count as the stronger level (AAL2) that a passkey or an authenticator app gives. See Assurance levels. Because the code is sent to your own mailbox, using it also means:

• the new-sign-in alert email is always sent, even from a browser you have used before (see The sign-in alert email);
• the sign-in is not remembered, even if you ticked Keep me signed in on this device;
• every other verified address on the account gets the email A sign-in skipped your passkey when the first code is sent, before the code is used. If you have no other verified address, the screen says You have no other verified address, so nobody else can be told.

A sign-in the platform judges too risky is still refused, and an application or organization that requires the stronger level refuses this sign-in at the end.

What this session cannot do#

Until you confirm with a passkey or an authenticator app, a session that began this way is refused these actions with a request to confirm a second factor used in the last 30 minutes (see Confirm it is you):

• ending your other sessions, or all of them (signing out of the session you are in stays possible);
• leaving an organization;
• accepting or declining an invitation to an organization;
• adding an email address;
• cancelling a recovery;
• revoking an application's access to your account;
• marking security events as read.

The code can be requested twice a day for an account. On the recovery page the address you typed is already filled in, and the page says Recovery for an account with a passkey or an authenticator app is held for 24 hours, and every address on the account is told when it starts. See Start a recovery.

To get a passkey back, use I lost my passkey. Recovery is the route that can replace it. See Start a recovery.

When the code is emailed, the screen shows Send again after a short wait. An account can ask for four codes in a row, and then two more for every six hours that pass. If you ask too often the screen says You have asked for too many sign-in codes. Use another way to confirm it is you, or wait a while and ask again. with the wait. If the service-wide daily limit for email is spent it says We have reached the limit for sending email today, so no message can be sent right now. Under each is Why does this happen? and a Reference: code to quote if you ask for help. Check the junk folder first, then use another way to confirm. See Sign in with an emailed link or code.

If you cannot use any of the ways, start account recovery.

• Sign in with a password
• Confirm it is you, which asks for a second factor in the middle of using your account