> ## Documentation Index
> Fetch the complete documentation index at: https://the-early-spring18.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Google Account Security: 2FA, Sessions, and Audit Logs
> Enable two-factor authentication, manage API key scopes, review active sessions, and set up IP allowlisting to protect your account.
Protecting your Google account goes beyond a strong password. The platform provides a layered security model that lets you combine two-factor authentication, finely scoped API keys, session monitoring, IP-based access restrictions, and a full audit trail. Configuring each of these controls significantly reduces the risk of unauthorized access and gives you clear visibility into all activity happening in your workspace.
## Two-Factor Authentication (2FA)
Two-factor authentication adds a second verification step at login, so even if your password is compromised, your account remains protected. You can enable 2FA using any TOTP-compatible authenticator app such as Google Authenticator, Authy, or 1Password.
Navigate to **Settings → Security** and click **Enable Two-Factor Authentication**.
Open your authenticator app, tap **Add Account** or the **+** icon, and scan the QR code displayed on screen. Your app will begin generating six-digit codes that refresh every 30 seconds.
Type the current six-digit code from your authenticator app into the confirmation field on the setup screen and click **Verify**.
After verification succeeds, the platform generates ten single-use backup codes. Download or print these codes and store them somewhere safe, such as a password manager or secure physical location.
Backup codes are shown **only once**. If you lose your authenticator device and do not have your backup codes, you will be locked out of your account and will need to contact support for identity verification before access can be restored.
## API Key Scopes
Every API key is created with an explicit scope that defines the maximum level of access it can exercise. Always assign the narrowest scope that meets your use case.
| Scope | Description | Example Use Case |
| ------- | ------------------------------------------------------------ | ---------------------------------------------------------- |
| `read` | Retrieve data only; no modifications allowed | Dashboards, analytics pipelines, read-only integrations |
| `write` | Create and update records; cannot delete or manage keys | Syncing external data into your workspace |
| `admin` | Full access including key management, billing, and deletions | Automated provisioning scripts, workspace management tools |
Scopes are set at creation time and **cannot be changed** after a key is generated. If you need a different scope for an existing integration, revoke the current key and issue a new one with the correct scope.
## Active Sessions
The Active Sessions view shows every device and location that currently has an authenticated session in your workspace, allowing you to spot and remove any access you do not recognize.
To review your sessions, go to **Settings → Security → Active Sessions**. Each entry shows:
* **Device type** (browser, mobile app, or API client)
* **Approximate location** based on IP geolocation
* **Last active** timestamp
* **Session ID** for precise identification
Click **Revoke** next to any individual session to immediately invalidate that session's authentication token. The device will be signed out on its next request.
Click **Revoke All Other Sessions** at the top of the list to sign out every session except the one you are currently using. Use this if you suspect your account has been accessed without your authorization.
## IP Allowlisting
IP allowlisting restricts API key authentication to requests that originate from a specific set of IP ranges. Requests from addresses outside your allowlist are rejected with a `403 Forbidden` response, regardless of whether they carry a valid API key.
To configure your allowlist:
Go to **Settings → Security → IP Allowlist**.
Click **Add Range**, enter the IP address or CIDR block you want to permit (for example, `203.0.113.0/24`), add an optional label for your own reference, and click **Save**.
Test an API call from one of the allowed addresses to confirm the allowlist is working as expected before enforcing it across all integrations.
To remove a range, click the **⋯** menu next to any entry and select **Delete**. Removal takes effect within 60 seconds.
IP allowlisting applies **only to API key requests**. Interactive web sessions authenticated via username and password or SSO are not subject to the IP allowlist and can originate from any address.
## Audit Log
The Audit Log provides a timestamped record of security-relevant events in your workspace. Use it to investigate anomalies, satisfy compliance requirements, or simply keep track of changes made by your team.
To access the log, go to **Settings → Security → Audit Log**. You can filter events by:
* **Event type** — Login, Key Created, Key Revoked, Data Changed, Member Invited, Role Changed
* **User** — filter to activity from a specific team member
* **Date range** — narrow results to a specific window of time
```json Example Audit Log Entry theme={null}
{
"timestamp": "2024-11-15T14:32:07Z",
"event_type": "api_key.created",
"actor": "jane.doe@example.com",
"resource": "api_key:prod-export-key",
"scope": "read",
"ip_address": "203.0.113.42",
"session_id": "sess_01HXYZ..."
}
```
Audit log entries are retained for **90 days** on the Pro plan and **365 days** on the Enterprise plan. Logs cannot be deleted or modified by any user.
Rotate your API keys every 90 days as a best practice, even if no compromise is suspected. Regular rotation limits the window of exposure if a key is ever leaked in a log, error message, or version control history. After generating a new key, update your integrations and immediately revoke the old key.