Two-Factor Authentication and Persistent API Keys in TinyPilot Pro

TinyPilot's August 2026 release adds two-factor authentication, persistent REST API keys, and a new Automation settings page for managing API access.

Two-factor authentication

User authentication helps keep your TinyPilot device secure, but a stolen password can still grant someone full access to your device.

With two-factor authentication (2FA), signing in requires your password and a six-digit code from an authenticator app like Google Authenticator, Authy, or 1Password. Open the username menu and choose "Manage Account."

Administrators can require two-factor authentication for all users and reset a user's enrollment if they lose access to their authenticator app.

For setup steps and recovery options, see our two-factor authentication FAQ.

REST API access with user authentication enabled

Until now, enabling user authentication on TinyPilot disabled the REST API. You had to choose between locking down the web interface and API-based automation.

This release removes that tradeoff. TinyPilot now uses persistent API keys that work while user authentication is enabled. You can attach your Automation license and manage keys from System > Automation - no SSH or command-line setup required.

For details on authentication and supported endpoints, see the TinyPilot REST API docs.

Full changelog

For the full list of changes in TinyPilot Pro 3.2.0, see the changelog.

Updating to the latest version

You can update to the latest version of TinyPilot by clicking System > Update in the navigation bar: