Account Security

Featureflip gives you two ways to strengthen how you sign in: two-factor authentication (2FA) adds a one-time code on top of your password, and social sign-in lets you use your Google or GitHub account instead of a separate password. Both are managed from your account, and you can use either, both, or neither.

Two-factor authentication

Two-factor authentication asks for a one-time code from an authenticator app in addition to your password, so a leaked password alone is not enough to sign in. Featureflip uses standard time-based one-time codes (TOTP), which work with any authenticator app — Google Authenticator, 1Password, Authy, and others.

Enabling two-factor authentication

1. Go to your Profile page.
2. Find the Two-Factor Authentication card and click Set up two-factor.
3. Scan the QR code with your authenticator app. If you cannot scan it, enter the shown key into the app manually.
4. Enter the 6-digit code from your app and click Enable.
5. Featureflip shows your recovery codes. Save them somewhere safe — see below.

Once enabled, every future sign-in asks for a code from your authenticator app after your password.

Recovery codes

When you enable 2FA, Featureflip gives you a set of recovery codes. Each code works once and is your backup way to sign in if you lose access to your authenticator app (for example, if you replace your phone). Store them somewhere separate from your password manager’s 2FA entry — printed, or in a secure note.

If you use some of your codes or want a fresh set, click Regenerate recovery codes on the Two-Factor Authentication card and confirm with your password. Regenerating invalidates your previous codes and replaces them with a new set.

Signing in with 2FA

After you enter your email and password, Featureflip prompts for your one-time code. Open your authenticator app, enter the current 6-digit code, and you are signed in. If you cannot reach your authenticator, use one of your recovery codes instead.

Disabling two-factor authentication

1. Go to your Profile page.
2. On the Two-Factor Authentication card, click Disable two-factor.
3. Enter your password to confirm.

Two-factor authentication is turned off, and future sign-ins ask for your password only.

Sign in with Google or GitHub

You can sign up and sign in to Featureflip with your Google or GitHub account instead of a password. On the sign-in screen, click Continue with Google or Continue with GitHub, complete that provider’s consent screen, and Featureflip creates or signs you into your account from your verified email address there.

• New to Featureflip? Continuing with a provider creates your account from your profile there, with no separate password to set.
• Already have a Featureflip account under the same email address? If that account’s email is already verified, signing in with the provider links to it, so you can use either your password or the provider going forward. If the email on the existing account has not been verified, Featureflip will not automatically link the two, as a safeguard against account takeover. Verify the account first.
• Two-factor authentication still applies. With 2FA enabled, Featureflip asks for your one-time code once the provider hands you back, exactly as it does after a password.

What GitHub sign-in reads

GitHub sign-in asks for the user:email scope, and Featureflip uses it to read your primary address along with GitHub’s own record of whether that address is verified. Google signs you in over OpenID Connect, which carries verification status in the sign-in response itself. GitHub uses OAuth 2.0, where that status is absent from the response, so the address has to be read from your GitHub account directly.

That has two consequences. Your public GitHub profile address is ignored when it differs from your primary one, so your Featureflip account is always created under the address that was checked. And a GitHub account whose primary address is unverified is turned away, because nobody has confirmed that the person signing in controls it.

Social sign-in is built on each provider’s OAuth. It is separate from single sign-on through your organization’s identity provider. OIDC single sign-on is on the Business plan, with setup guides for Okta and Microsoft Entra ID, and SAML / SCIM on Enterprise. Contact us if your organization needs SAML.

Next steps

• Team Management — invite members and manage roles for your organization
• Audit Log — review changes made across your flags and environments
• Security at Featureflip — where your data is stored, how SDK keys limit exposure, and how to report a vulnerability