Password plus 6-digit authenticator code.
Both factors are required. Failed attempts per IP are capped.
A demo code grants one hour of read-only dashboards. It is single use. Admin tools are not reachable with a demo code.