The Account Security block gives the people who sign up and log into your Web Application their own account security tools, two-factor authentication, passkeys, a list of their signed in devices, and data export/delete, completely separate from the two-factor authentication you might have set up on your own CodeBlock Studio account (see "Setting up two-factor authentication (2FA)" in Security & Privacy, that one only protects your builder login).
Setting it up
Drag an Account Security block onto any page a logged in user can reach (a settings or account page is the natural place). It renders as a self contained panel covering every one of these features at once, there's nothing extra to configure on the block itself.
Two-factor authentication: authenticator app or email code
An end user opens the panel and can turn on either (or both): an authenticator app code, they scan a QR code with an app like Google Authenticator, Authy, or 1Password, enter the 6 digit code to confirm, and get a set of backup codes to save, or an email code, a 6 digit code sent to their own address each time, confirmed the same way. The next time that end user logs in with a password, a passkey, or a magic link, they're asked for a fresh code right after it, the same challenge after first factor pattern your own CodeBlock Studio account uses, and it applies no matter which sign in method they used to get there, so it isn't bypassable just by picking a different one.
Tip: SMS codes aren't available as a second factor today, only an authenticator app and email. If enough projects need it, a phone number based option using your own connected Twilio account is a reasonable future addition, see the SMS Action block for the account it would reuse.
Passkeys
An end user can also register a passkey, Face ID, Touch ID, Windows Hello, or a hardware security key, right from this same panel, then use "Sign in with a passkey" on your Login Form instead of typing a password at all. They can register more than one and remove any of them later from this panel.
Signed in devices
The panel lists every device currently signed into that end user's account (based on its browser, shown as something readable when possible) with a last active time, and a button to sign out any one of them, or all of them at once except the device they're using right now.
Export and delete
"Export my data" downloads a JSON file with that end user's own account details, every record they own across every collection in your app, and metadata about their sessions and passkeys, never a password or any other secret. "Delete my account" permanently removes the account after confirming their password, and this cascades: every record they own in every collection, every session, and every passkey is deleted along with it. There's no separate confirmation step from you as the project owner, and no way to undo it once it's done.
Tip: This is entirely optional per end user, turning any of it on doesn't require anything from you as the project owner beyond having placed the block somewhere they can reach it.