Reset 2FA

Reset two-factor authentication (2FA) from the server terminal when an account cannot complete the 2FA challenge and has no usable recovery codes. The reset removes the account's current authenticator setup and recovery codes. It does not change the account password.

Self-hosted instances only

Coolify Cloud users cannot access the container required for this procedure. If you cannot complete the 2FA challenge for a Coolify Cloud account, contact the Coolify team.

Choose the right recovery method

Use the first method that is available:

Enter a current code from the account's authenticator app.
Enter one of the recovery codes saved when 2FA was configured.
If authenticator codes are rejected even though the correct account is selected in the app, check 2FA time synchronization before clearing the setup.
Use the terminal procedure below when the authenticator and recovery codes are unavailable.

Before you reset 2FA

Make sure you have:

SSH access to the server that runs the self-hosted Coolify instance
permission to run Docker commands on that server
the email address of the affected account, unless you are resetting the root account
the account password required for the login check after the reset

If you are resetting the root account and do not know its password, follow Reset Root Password before verifying access.

The current 2FA setup will be removed

This procedure clears the selected account's authenticator secret and recovery codes. The existing authenticator entry and every recovery code for that account will stop working. Configure 2FA again after access is restored.

Reset 2FA from the server

Connect to the Coolify server

Connect over SSH to the machine that runs the Coolify control plane:

ssh root@<server-ip>

Replace <server-ip> with the server's IP address. If you connect as a non-root user, that account must have permission to run Docker commands. Add sudo before the Docker commands below when your server requires it.

Confirm that the Coolify container is running

docker inspect --format '{{.State.Status}}' coolify

The command should print running. If it does not, update or repair the Coolify installation before continuing.

Open Laravel Tinker

Run Tinker inside the coolify container:

docker exec -it coolify php artisan tinker

Wait for the > prompt before entering the PHP commands in the following steps.

Select the affected account

Select the root account by user ID 0:

$user = App\Models\User::find(0);

Verify the selected account

$user?->only(['id', 'email', 'two_factor_confirmed_at']);

Tinker should print the expected user ID and email address. two_factor_confirmed_at normally contains a timestamp when 2FA is enabled.

If Tinker prints null or shows a different account, do not continue. Select the correct account first.

Clear the 2FA setup

$user->two_factor_secret = null;
$user->two_factor_recovery_codes = null;
$user->two_factor_confirmed_at = null;
$user->save();

The final command should return true. These assignments update only the selected account's 2FA fields.

Verify the database update

$user->refresh()->only([
    'two_factor_secret',
    'two_factor_recovery_codes',
    'two_factor_confirmed_at',
]);

Tinker should report null for all three fields:

[
  "two_factor_secret" => null,
  "two_factor_recovery_codes" => null,
  "two_factor_confirmed_at" => null,
]

Exit Tinker:

exit;

Coolify does not need to restart after this update. Deployed applications, databases, and services are not affected.

Verify account access

Open the Coolify login page in a private browser window. Sign in with the affected account's email address and password.

You should be able to sign in without seeing the 2FA challenge. If the account is the root account and its email address is also unavailable, follow Change Root Email.

Configure 2FA again

After signing in:

Open Profile > General.
Under Two-factor Authentication, select Configure.
Add the new setup to your authenticator app and validate it with a current code.
Store the new recovery codes in a secure location outside the Coolify server.
Sign in through a private browser window again and confirm that the new authenticator code works.

The authenticator secret and recovery codes cleared during the reset cannot be reused.