Confirm it is you

The prompt that asks for a second factor you used recently before a sensitive action, and how to answer it.

On this page

Being signed in is not always enough. Before a sensitive action, such as changing how you sign in, downloading an export of your data, or closing your account, the platform asks you to prove again that it is you. This is called a step-up. It says This needs a second factor used in the last 30 minutes. If you already used a second factor in the last 30 minutes, you are not asked again.

In your account: the dialog#

Most of the time you see a dialog over the page you were on, titled Confirm it is you. You can answer in the ways your account has:

To use a passkey, select Use a passkey and approve the prompt. While it waits, the button reads Waiting for your device.
If your session began with a password sign-in, you can use an authenticator app: type the six digit code in Authenticator code and select Confirm. The hint says Six digits from your authenticator app.
Where the account has a linked provider that can confirm, a button reads Continue with and the provider's name. You leave the page to confirm with the provider. When you come back, repeat what you were doing: nothing has been changed yet.
If your session began with a passkey, or with a linked provider that asked for its own second factor, you can also confirm with your account password. Open Other ways to confirm, type it in Account password and select Confirm with password. This is not offered after a sign-in that started with your password, an email link or recovery.

When you are confirmed, the action you were doing goes ahead. If you select Cancel, the dialog says Nothing was changed.

A few pages are gated rather than prompted: they ask before they show anything at all, for example Confirm it is you to see this page, which says This page lists sensitive account details, so it needs a second factor used in the last 30 minutes.

The Confirm it is you dialog over the Security page: it needs a second factor used in the last 30 minutes, and offers a passkey and a six-digit code from an authenticator app. — Confirm it is you: security pages ask for a second factor used in the last 30 minutes. Sample data./account/security

The full page#

If you land on the prompt from a link, or you reload the tab, you see the same ask on a full page, titled Confirm it is you, which says This needs a fresh confirmation. The choices are Use a passkey, or Authenticator app code with Verify. The full page does not offer the password. When it succeeds, the page says Confirmed. and takes you back to where you were. Cancel, in the footer, takes you back without confirming.

What can go wrong#

What you see	What it means
This account has no second factor to confirm with. Set one up on the Security page, then come back.	You have no passkey and no authenticator app. Select Open Security and add one. See Security and passkeys.
No second factor on this account can confirm this here. Sign in again with a passkey or an authenticator app.	The ways you have cannot answer this prompt in this place. Sign in again with one of them.
The passkey was not accepted. Try again or use another method.	The passkey did not pass. Try again, or use the code.
This browser cannot use passkeys here.	Use the authenticator code instead.
That code is not right or has expired.	Check the digits and try again.
Confirm it is you to continue. or Confirm it is you with a stronger sign-in method to continue.	The action needs a confirmation, or a stronger one than the one you used to sign in. Complete the prompt.
This browser is new to your account. You can make this change from it 24 hours after you confirm it by signing in with a link or code emailed to you, or from a browser you already use.	Some changes are held back from a browser your account has only just seen, and a sign-in with the password alone does not make a browser known. Use a browser you already sign in from, or sign in here once with an emailed link or code and come back after a day.
The confirmation did not finish.	A confirmation through a linked provider did not complete. Start again.
Your organization manages this account, so this is not available here. Ask your organization’s administrator.	The account is managed by an organization and has nothing of its own to confirm with, so the change is not available on your own account pages. See Single sign-on and managed accounts.

After "Continue with my password only"#

A sign-in that used Continue with my password only (limited session) (see The second step) is at the lower level. Every action that needs a second factor shows this prompt rather than a plain refusal: changing how you sign in, creating tokens, exporting or deleting your data. The same holds for a change that is held back on a browser the account has only just seen, if the account has a passkey or an authenticator app: you are asked to confirm it is you instead of being told to wait 24 hours. An account with no second factor still sees This browser is new to your account. and waits. When you confirm with your passkey or authenticator app, the browser also stops counting as new, which starts its 24 hours.

After the lost-passkey code#

A sign-in finished with Email me a code instead (see The second step) has not used a second factor. Every step-up and every account change that needs a second factor therefore asks you to confirm with a passkey or an authenticator app, and the check that lets a long-trusted browser change a sign-in method does not apply to such a session: only a confirmed second factor does. If you have no passkey you can reach, start account recovery.

After the emailed code for a lost passkey#

A sign-in that used the emailed code for a lost passkey (see The second step) is one level lower than a passkey. Until you confirm with a passkey or an authenticator app, it is refused ending your other sessions, leaving an organization, accepting or declining an invitation, adding an email address, cancelling a recovery, revoking an application's access and marking security events read, and it gets this prompt for a second factor used in the last 30 minutes. A password alone does not satisfy it.

The extra steps do not count#

The optional extra steps, Use my password and Email me a code, do not count as a second factor here. See Optional extra steps.