Setting up multi-factor authentication

Multi-factor authentication (MFA) adds a second verification step to your OpenReview login. After you enter your password, OpenReview asks for a one-time code or a passkey, so your profile stays protected even if someone learns your password.

OpenReview supports three verification methods:

• Authenticator app — a 6-digit code generated by an app such as Google Authenticator, Microsoft Authenticator, or 1Password.

• Passkey — Touch ID, Face ID, Windows Hello, or a hardware security key.

• Email — a 6-digit code sent to your email address.

You can enable more than one method, and you can switch between them when you sign in.

Opening your security settings

1. Sign in to OpenReview.

2. Click your name in the top right corner and select Password & Security.

3. Expand the Multi-Factor Authentication section.

Each method is shown as a card that indicates whether it is currently enabled. If you have not set up any method yet, the page displays a notice that multi-factor authentication is disabled, and a similar reminder appears on your profile edit page.

The Multi-Factor Authentication section before any method has been set up.

Setting up an authenticator app

1. On the Authenticator App card, click Set up.

2. Scan the QR code with your authenticator app.

3. Enter the 6-digit code shown in your app and click Verify.

Scanning the QR code and confirming the first generated code enables the authenticator app.

The QR code is valid for 10 minutes. If setup expires before you finish, close the panel and click Set up again to generate a new code.

Scripts you run yourself with the Python client simply ask you for the code. For scripts that run unattended, follow Using multi-factor authentication in unattended scripts instead of these steps: they need the setup secret as text, and the website only shows it as a QR code.

Setting up a passkey

1. On the Passkey card, click Set up.

2. Enter a name that will help you recognise the device later, such as Laptop Touch ID. A name is required.

3. Click Add Passkey and complete the prompt shown by your browser or operating system.

You can register several passkeys — for example, one per device. To add or remove them later, click Edit on the Passkey card. Removing every passkey disables the passkey method.

Setting up email codes

On the Email card, click Enable. The method is switched on immediately; there is no confirmation step.

When you sign in, the one-time code is sent to the email address you signed in with, which is not necessarily the preferred address on your profile. Make sure you can receive mail at the address you use to log in.

Each emailed code is valid for 10 minutes.

Saving your recovery codes

The first time you enable any method, OpenReview generates 10 recovery codes and displays them once. Use Download or Copy to Clipboard and store them somewhere safe — they are your last way into your account if you lose access to every other method.

Each recovery code can be used only once. The Recovery Codes card shows how many remain unused.

Recovery codes are displayed once, when you enable your first method.

Recovery codes are shown only once and cannot be retrieved later. Clicking Generate New Code issues a fresh set of 10 and invalidates every previously issued code, including unused ones.

Choosing your preferred method

If you enable more than one method, click Set as Preferred on the card you want OpenReview to offer first when you sign in. You can still choose any of your other enabled methods at login.

Enabled methods are highlighted, and the Recovery Codes card tracks how many codes remain.

Signing in with multi-factor authentication

After you enter your username and password, OpenReview shows a verification step using your preferred method. On that screen you can:

• Enter the code from your authenticator app or email, or confirm with your passkey.

• Select Log in using… to switch to another method you have enabled.

• Select Log in using Recovery Code to use one of your recovery codes.

• Tick Do not ask for a code on this device for the next 30 days to skip verification on that browser in future.

The verification step shown after your password, with alternative methods listed below.

If you cannot sign in

After 5 consecutive incorrect codes, verification is locked for 15 minutes. Wait for the lockout to expire, then try again.

If you have lost access to your authenticator app, passkey, and email, sign in with one of your recovery codes and set up a new method straight away. If you no longer have your recovery codes either, contact OpenReview through the Feedback Form.

Turning off a method

Open Password & Security → Multi-Factor Authentication, then:

• Authenticator App — click Disable, then confirm with Disable Authenticator App.

• Email — click Disable.

• Passkey — click Edit and delete the passkeys you no longer want. Removing the last one disables the method.

Disabling your last remaining method turns multi-factor authentication off for your profile.

We strongly recommend keeping at least one method enabled. Author, reviewer, and program chair accounts control submissions and reviews, and a password on its own is a single point of failure.