Sign in and use two-factor codes

How signing in works, why a second step matters, and what to do when you cannot sign in.

Bloomtack can publish to your Pinterest account, so your sign-in deserves a second lock. Two-factor sign-in adds a six-digit code from an app on your phone after your password.

Sign in

1. Open https://app.bloomtack.com and press Sign in.
2. Use the same method you signed up with: email and password, Google, or a passkey.
3. If two-factor is on for your account, enter the code from your authenticator app.

Sign-in happens on a page run by WorkOS, our sign-in service. Bloomtack never sees your password.

You stay signed in on that device for up to 7 days without activity and at most 30 days in total. After that, Bloomtack asks you to sign in again.

Two-factor codes

Turn two-factor on in Settings → Account, in the Two-factor sign-in card. You need an authenticator app such as Google Authenticator, Microsoft Authenticator, 1Password or Authy:

1. Press Add an authenticator app. If you signed in more than 5 minutes ago, Bloomtack asks you to sign in again first.
2. Press Show the QR code and scan it with the app. If the app is on the phone you are using, press Open in authenticator app instead, or type the key into the app by hand.
3. Enter the six-digit code the app shows and press Add this app.

From then on, every sign-in with a password asks for a fresh code.

The QR code and the key are shown once, for 10 minutes. If you leave before entering a code, nothing changes on your account; start again to get a new QR code. After five wrong codes the setup is thrown away for the same reason.

You can add up to three apps, for example one on a second phone, and remove one from the same card. Removing your only app turns two-factor sign-in off, so Bloomtack asks you to type TURN OFF first.

Each time an app is added or removed, Bloomtack sends an email to the address on your account. If you get that email and did not make the change, change your password and write to hello@bloomtack.com.

Passkeys

A passkey lets you sign in with your phone's or computer's fingerprint, face or PIN instead of a password. Passkeys cannot be phished, so they are the safest choice when your device supports them.

You create a passkey on the sign-in page, when it offers to. A passkey cannot be added or removed in Settings → Account; to remove one, contact support.

If something goes wrong

• Forgot your password: use the reset link on the sign-in page. The email comes from the sign-in service, not from your blog.
• Lost the phone with your authenticator: email hello@bloomtack.com from the address on your account. Support checks who you are before removing two-factor, which can take a working day.
• Signed out unexpectedly: sessions end after 7 days without activity. Sign in again; nothing in your workspace is lost.
• Sign-in shows an error in Bloomtack: it comes with a short message. If it keeps happening, send the message and any error ID to support. See Error IDs and getting help.

Updated October 1, 2026.