Signing in, two-factor codes and recovery codes

Help page for everyone who signs in to Agenti.

The short version

Sign in with your username and password, then the 6-digit code from your authenticator app — or, if your admin has turned it on, with a passkey (your device's own fingerprint, face or PIN check), which needs no password at all.
Lost your phone? Use one of the recovery codes you saved when you set up two-factor authentication. Click Lost your device? Use a recovery code under the code field, type one code (it looks like a1b2c-3d4e5), and you're in. Each recovery code works once.
Wherever the site asks you to confirm it's you before a sensitive action (changing your password, granting someone access, building an agent), the same popup appears: your password and a 2FA code, or a passkey — and the same Lost your device? link accepts a recovery code there too.

Common questions

I typed my username with a capital letter and it didn't work. Usernames are lowercase. The sign-in page now lowercases what you type, so Alex and alex are the same account.

The code field only shows a number keypad on my phone. How do I type a recovery code? Tap Lost your device? Use a recovery code first — the field switches to a normal keyboard and accepts the xxxxx-xxxxx format, with or without the dash.

I've used all my recovery codes / I never saved them. An admin has to reset your two-factor authentication: ask them to run sudo agenti admin principal reset-2fa <your-username> on the host, or to use Reset MFA in your user's security settings. You'll set 2FA up again at your next sign-in.

Why was I signed out after changing my password or 2FA? Changing how you sign in ends every session, including the one you did it from, so a session someone else might hold can never outlive the old credentials. Sign in again with the new details.

What does "You've signed out." mean on the sign-in page? Exactly that: you pressed Log out, the server ended your session, and the cookie is dead everywhere. It's confirmation, not an error.

How short can a password be? At least 8 characters, on every page that sets one (first-time set-up, a reset link, and Settings → Security).

What an error means

Message	What it means	What to do
"Too many attempts — this account is temporarily locked."	Several wrong passwords or codes in a row.	Wait 15 minutes, then try again. The lock clears on its own.
"that code has already been used"	A 2FA code works once per 30 seconds.	Wait for the app to show the next code.
"Enter one of your recovery codes (xxxxx-xxxxx)."	What you typed isn't a recovery code.	Check for a missing character; the dash is optional.
"Passkeys need the real domain…"	You opened the site by its IP address or an old bookmark.	Open the address shown in the message and try again.