Miru Now Supports 2FA: Authenticator Apps and Passkeys

Miru Now Supports 2FA: Authenticator Apps and Passkeys is another step toward one calm workflow from tracked time to paid invoice.

Your Miru account just got a lot more secure. TOTP authenticator apps and passkey sign-in are live today. We write from operating experience, not trend-chasing.

TOTP Authenticator Apps

Two-factor authentication via TOTP (time-based one-time passwords) is live now for all Miru accounts. It works with any authenticator app — Google Authenticator, 1Password, Bitwarden, Authy, whatever you already use.

Setup takes three steps:

1. Go to Profile > Settings > Authenticator App 2FA and click “Set up 2FA.”
2. Copy the secret key into your authenticator app (or scan the provisioning URI if your app supports it).
3. Enter the 6-digit code your app generates. Done.

From that point on, every sign-in requires your password plus a fresh code from your authenticator. The code rotates every 30 seconds. Even if someone gets your password from a data breach or phishing attempt, they can’t get in without physical access to your device.

When you enable 2FA, Miru generates a set of one-time recovery codes. Save them somewhere safe — a password manager, a printed sheet in a locked drawer, wherever you keep important things. Each code works once. They’re your fallback if you lose your phone or switch authenticator apps.

Passkey Support

Passkeys are the newer standard. Instead of typing a password and then a code, you authenticate with your device’s biometrics — fingerprint, face scan, or hardware security key. One gesture. No codes. No phishing possible because the credential is bound to the domain.

Miru now supports passkey sign-in alongside traditional password + TOTP. You can use either. You can use both. The passkey option shows up on the sign-in page if your browser supports WebAuthn (Chrome, Safari, Firefox, and Edge all do).

For teams that standardize on hardware keys like YubiKeys, this is the setup you’ve been waiting for.

What’s Not Here Yet

SSO and SAML. If you’re a larger organization that manages authentication through Okta, Azure AD, or Google Workspace, we hear you. SSO is on the roadmap for the Enterprise plan. It’s the kind of feature that requires careful implementation — getting the session lifecycle, provisioning, and de-provisioning right matters more than shipping it fast.

For now, 2FA via authenticator apps and passkeys covers the vast majority of teams. It’s a massive improvement over password-only access, and it’s available today on every plan, including the free tier.

Turn It On

Go to your profile settings. It takes sixty seconds. The security of your clients’ financial data shouldn’t depend on whether someone reused a password from a 2019 LinkedIn breach.

Your data deserves better than a single password. Now it has it.

Hard Stop

Use it in production and tell us exactly where the workflow still fights you.

Start with Miru or read the docs.

Vipul A M

Co-founder at Saeloun. Building Miru. Rails contributor. Shipping from Pune, India.