
| Method | What you need | Good to know |
|---|---|---|
| Authenticator app | An app on your phone, such as Google Authenticator, Microsoft Authenticator or 1Password | It shows a new 6-digit code every 30 seconds. You can have one app at a time. See Set up an authenticator app. |
| Passkeys | Your fingerprint, face or screen lock (for example Touch ID, Face ID or Windows Hello) | A passkey also lets you sign in without a password. You can add several. See Add a passkey or a security key. |
| Security keys | A physical key, such as a YubiKey | You can add several. |
| Recovery codes | Nothing; you save 16 one-time codes | For when you lose your other methods. They appear once you have turned on another method. See Recovery codes. |
Passkeys and security keys only appear when your browser supports them and you are on the main Shorter Loop address. If your company uses its own web address for Shorter Loop, you can use an authenticator app and recovery codes there.

| How you sign in | Second step? |
|---|---|
| Email and password | Yes |
| Google, LinkedIn or Google One Tap | Yes |
| A 6-digit code sent to your email | Yes |
| Company single sign-on (SAML, Okta, Entra ID, Google Workspace) | No. Your company's identity provider already checks you, often with its own second step. |
| A passkey | No. A passkey already proves two things: you have the device, and you unlocked it. |
| Word | Meaning |
|---|---|
| Second step | The page after your password that asks for a code or your key. |
| Method | One way to do the second step: your authenticator app, a passkey, a security key or a recovery code. |
| Preferred method | The method the second step offers first. You can still pick another one. |
| Session | One browser that is signed in to your account. |
| Confirm it's you | A short check before a security change, even when you are already signed in. See Confirm it's you. |
| Security log | Your own list of sign-ins and security changes. |