Two-factor authentication (2FA)
Protect sign-in and API token access with email codes or Google Authenticator, and keep recovery codes safe.
Turn it on
Open Security and choose how you want to verify at sign-in:
- Email codes — we email a one-time code each time you sign in.
- Google Authenticator — scan the QR code (or type the manual key) in an authenticator app and enter the 6-digit code it shows.
You confirm with your password, then with a code. We recommend an authenticator app: it works even when email is slow.
Save your recovery codes
When 2FA is turned on you get 10 recovery codes, shown only once. Copy or download them and keep them somewhere safe outside your phone. Each code works once instead of a 2FA code — for example if you lose your phone.
Generate new recovery codes replaces the whole set; the old codes stop working.
Trusted devices
Tick Trust this device for 30 days when you sign in to skip the code on that browser. You can remove trusted devices under Security → Devices & login history. Never trust a shared or public computer.
Where 2FA is used
Besides sign-in, your 2FA code is asked when you reveal, rotate or create API keys, and when you close your account. Email codes are only valid for a short time, and after too many wrong codes you have to start the sign-in again.
Turn it off or lost access
Disable two-factor authentication needs your password plus a current code or a recovery code. If you lost both your authenticator and your recovery codes, contact support from your registered email address — we'll verify your identity before we change anything.
