# Two-factor authentication (2FA)

> Protect sign-in and API token access with email codes or Google Authenticator, and keep recovery codes safe.

Canonical page: https://buildpropfirm.com/help/two-factor-authentication  
Topic: Your account & security  
Last updated: 2026-11-08

## 1. Turn it on

Open **Security** and choose how you want to verify at sign-in:

- **Email codes** — we email a one-time code each time you sign in.
- **Google Authenticator** — scan the QR code (or type the manual key) in an authenticator app and enter the 6-digit code it shows.

You confirm with your password, then with a code. We recommend an authenticator app: it works even when email is slow.

## 2. Save your recovery codes

When 2FA is turned on you get **10 recovery codes**, shown only once. Copy or download them and keep them somewhere safe outside your phone. Each code works once instead of a 2FA code — for example if you lose your phone.

**Generate new recovery codes** replaces the whole set; the old codes stop working.

## 3. Trusted devices

Tick **Trust this device for 30 days** when you sign in to skip the code on that browser. You can remove trusted devices under **Security → Devices & login history**. Never trust a shared or public computer.

## 4. Where 2FA is used

Besides sign-in, your 2FA code is asked when you reveal, rotate or create API keys, and when you close your account. Email codes are only valid for a short time, and after too many wrong codes you have to start the sign-in again.

## 5. Turn it off or lost access

**Disable two-factor authentication** needs your password plus a current code or a recovery code. If you lost both your authenticator and your recovery codes, [contact support](https://buildpropfirm.com/help/contact-support) from your registered email address — we'll verify your identity before we change anything.

## Related guides

- [Sign-in problems and passwords](https://buildpropfirm.com/help/sign-in-and-passwords): Reset a forgotten password, change your password, why sign-in can be locked, and how to sign out other devices.