Google Account Security: 2FA, Sessions, and Audit Logs

Enable two-factor authentication, manage API key scopes, review active sessions, and set up IP allowlisting to protect your account.

Protecting your Google account goes beyond a strong password. The platform provides a layered security model that lets you combine two-factor authentication, finely scoped API keys, session monitoring, IP-based access restrictions, and a full audit trail. Configuring each of these controls significantly reduces the risk of unauthorized access and gives you clear visibility into all activity happening in your workspace.

Two-Factor Authentication (2FA)

Two-factor authentication adds a second verification step at login, so even if your password is compromised, your account remains protected. You can enable 2FA using any TOTP-compatible authenticator app such as Google Authenticator, Authy, or 1Password.

1. Open Security Settings

   Navigate to Settings → Security and click Enable Two-Factor Authentication.

2. Scan the QR Code

   Open your authenticator app, tap Add Account or the + icon, and scan the QR code displayed on screen. Your app will begin generating six-digit codes that refresh every 30 seconds.

3. Enter the Verification Code

   Type the current six-digit code from your authenticator app into the confirmation field on the setup screen and click Verify.

4. Save Your Backup Codes

   After verification succeeds, the platform generates ten single-use backup codes. Download or print these codes and store them somewhere safe, such as a password manager or secure physical location.

Backup codes are shown only once. If you lose your authenticator device and do not have your backup codes, you will be locked out of your account and will need to contact support for identity verification before access can be restored.

API Key Scopes

Every API key is created with an explicit scope that defines the maximum level of access it can exercise. Always assign the narrowest scope that meets your use case.

Scope	Description	Example Use Case
read	Retrieve data only; no modifications allowed	Dashboards, analytics pipelines, read-only integrations
write	Create and update records; cannot delete or manage keys	Syncing external data into your workspace
admin	Full access including key management, billing, and deletions	Automated provisioning scripts, workspace management tools

Scopes are set at creation time and cannot be changed after a key is generated. If you need a different scope for an existing integration, revoke the current key and issue a new one with the correct scope.

Active Sessions

The Active Sessions view shows every device and location that currently has an authenticated session in your workspace, allowing you to spot and remove any access you do not recognize.

To review your sessions, go to Settings → Security → Active Sessions. Each entry shows:

• Device type (browser, mobile app, or API client)
• Approximate location based on IP geolocation
• Last active timestamp
• Session ID for precise identification

Revoke a Single Session

Click Revoke next to any individual session to immediately invalidate that session’s authentication token. The device will be signed out on its next request.

Revoke All Other Sessions

Click Revoke All Other Sessions at the top of the list to sign out every session except the one you are currently using. Use this if you suspect your account has been accessed without your authorization.

IP Allowlisting

IP allowlisting restricts API key authentication to requests that originate from a specific set of IP ranges. Requests from addresses outside your allowlist are rejected with a 403 Forbidden response, regardless of whether they carry a valid API key.

To configure your allowlist:

1. Navigate to IP Allowlist Settings

   Go to Settings → Security → IP Allowlist.

2. Add a CIDR Range

   Click Add Range, enter the IP address or CIDR block you want to permit (for example, 203.0.113.0/24), add an optional label for your own reference, and click Save.

3. Verify Connectivity

   Test an API call from one of the allowed addresses to confirm the allowlist is working as expected before enforcing it across all integrations.

4. Remove a Range

   To remove a range, click the ⋯ menu next to any entry and select Delete. Removal takes effect within 60 seconds.

IP allowlisting applies only to API key requests. Interactive web sessions authenticated via username and password or SSO are not subject to the IP allowlist and can originate from any address.

Audit Log

The Audit Log provides a timestamped record of security-relevant events in your workspace. Use it to investigate anomalies, satisfy compliance requirements, or simply keep track of changes made by your team.

To access the log, go to Settings → Security → Audit Log. You can filter events by:

• Event type — Login, Key Created, Key Revoked, Data Changed, Member Invited, Role Changed
• User — filter to activity from a specific team member
• Date range — narrow results to a specific window of time

Example Audit Log Entry

{
  "timestamp": "2024-11-15T14:32:07Z",
  "event_type": "api_key.created",
  "actor": "[e-mail]",
  "resource": "api_key:prod-export-key",
  "scope": "read",
  "ip_address": "203.0.113.42",
  "session_id": "sess_01HXYZ..."
}

Audit log entries are retained for 90 days on the Pro plan and 365 days on the Enterprise plan. Logs cannot be deleted or modified by any user.

Rotate your API keys every 90 days as a best practice, even if no compromise is suspected. Regular rotation limits the window of exposure if a key is ever leaked in a log, error message, or version control history. After generating a new key, update your integrations and immediately revoke the old key.