Two-Factor Authentication

Two-Factor Authentication

Two-factor authentication adds an additional security layer to the account. After entering the normal username and password, the user must also provide a temporary verification code generated by an authenticator application.

In this article

Overview

When two-factor authentication is enabled, account access requires two verification factors:

Primary credentials The regular account username and password.
Authentication code A six-digit code generated by the authenticator application on the registered mobile device.
Recovery code A one-time backup code that can be used when the registered device is unavailable.
!

Authenticator application required

Install a compatible authenticator application, such as Google Authenticator, on the mobile device before beginning the setup.

Enable Two-Factor Authentication

1

Open the account menu in the upper-right corner of the dashboard and click Settings.

Account Settings button
Open the account menu and select Settings.
2

In the settings window, open the Account tab and click Set Up Two-Factor Authentication.

Confirm the current account password when prompted.

Set Up Two-Factor Authentication button
Click Set Up Two-Factor Authentication in the Account tab.
3

Open the authenticator application on the mobile device and add a new account using one of the available methods:

  • Scan the displayed QR code.
  • Enter the account and secret key manually.

The authenticator application generates a six-digit verification code that is refreshed approximately every 30 seconds. Enter the current code in the dashboard and click Next.

Register authentication application
Scan the QR code or enter the setup details manually, then verify the generated code.
4

Save the displayed recovery codes. These codes provide one-time access when the authenticator device cannot be used.

Use Download or Copy to store the codes securely. Select I’ve saved the data and click Done.

Save recovery codes
Download or copy the recovery codes and confirm that they have been saved.
!

Keep recovery codes secure

Recovery codes may be the only way to restore access after losing the registered mobile device. Each code can be used only once. Store them in a secure password manager or another protected location.

Sign In with Two-Factor Authentication

After two-factor authentication is enabled, complete the normal sign-in process with the account login and password. The platform then requests an additional security code.

Enter either:

  • The current six-digit code from the authenticator application.
  • One unused recovery code when the registered device is unavailable.
Two-factor authentication login dialog
Enter the authenticator code or a recovery code and click Verify.
✓

Expected result

The account is protected by two-factor authentication, and every dashboard login requires an additional verification code.

Manage Recovery Codes

Accounts with two-factor authentication enabled can display, download, copy, or regenerate their recovery codes.

1

Go to Settings > Account and click View Recovery Codes.

Confirm the account password to continue.

View Recovery Codes button
Click View Recovery Codes in the Account settings.
2

Review the currently available recovery codes. Use Download or Copy to save them.

View and regenerate recovery codes
View, download, copy, or begin regenerating recovery codes.
3

Generate a new set of codes when the existing codes have been used or may have been exposed. Click the recovery-code regeneration link and confirm the operation.

Updated recovery codes
Save the newly generated recovery codes immediately.
!

Previous codes become invalid

After a new set of recovery codes is generated, all earlier recovery codes stop working.

Disable Two-Factor Authentication

1

Open Settings > Account and click Disable Two-Factor Authentication.

Disable Two-Factor Authentication button
Click Disable Two-Factor Authentication in the Account settings.
2

Confirm the decision and enter the current account password. Click Continue to complete the operation.

Password confirmation dialog
Confirm the account password before disabling two-factor authentication.
✓

Device-loss recovery

When the registered device is lost, use an unused recovery code to sign in. Two-factor authentication can then be disabled or configured again with a new device.

After deactivation, the account can be accessed using only the normal login and password.

Use API with Two-Factor Authentication

For an account protected by two-factor authentication, API authentication requires an additional verification step after the normal sign-in request.

Step 1 Call the standard SignIn method using the account credentials.
Step 2 Call the Verify2FACode method and provide the current six-digit authenticator code.
Recommended option Use a personal access token for API requests and automation scripts to avoid interactive two-factor verification.
!

Automation recommendation

Personal access tokens are generally more suitable than account passwords and temporary authenticator codes for integrations, command-line tools, and automated scripts.

Related Documentation