Two-step verification

With two-step verification, your password is not enough to sign in to the client area: you also need a 6-digit code that changes every 30 seconds in the authenticator app on your phone. If someone finds out your password, they still cannot get in.

You need an authenticator app: Google Authenticator, Microsoft Authenticator, Aegis, 1Password or another one that reads "TOTP" QR codes.

Turning it on

1. Open My account and, in Two-step verification, press Turn on.
2. Enter your password.
3. Scan the QR code with the app. If you can't, type the key shown below the QR code by hand; if you are on your phone, tap Open in the app.
4. Enter the 6-digit code the app shows and press Confirm and turn on.
5. Save the 10 recovery codes: copy them into a password manager or download the .txt file and keep it away from the phone. You see them only once.

When you turn it on, the other sessions open with your account are closed and you get a confirmation email.

Everyone has their own: the people in your team also turn it on from their account, with their phone.

Signing in

After email and password, enter the app code. If you don't have your phone with you, press Use a recovery code and enter one of the saved codes: each one works once. When you sign in with a recovery code you get an email and the panel tells you how many codes you have left.

Codes running out or a new phone

• New recovery codes (an app code is needed) creates 10 new codes; the old ones stop working. When only a few are left, the page reminds you.
• New phone: sign in with a recovery code, press Turn off (password and code), then Turn on with the new phone.

If you lost both the phone and the codes, contact support: once they have checked it's you, they remove the verification and next time you sign in with your password alone. If you are a person in an account's team, ask the owner or a team administrator: they do it from the Team & API page.

Required

Your provider can make it required. In that case, after your password, the panel asks you to turn it on before going on: it takes a minute.

What doesn't change

• Your scripts' API keys work as before, with no code.
• If you come into the panel from your provider's website (the billing client area, with the direct sign-in button), you come in without a code: you are already signed in there.