Two-Factor Sign-In

Two-factor sign-in asks for a six-digit code from an authenticator app after every sign-in, whether you used a link, GitHub or a password. It is optional and off until you turn it on.

Turning It On

1. Open Account, then Two-Factor Sign-In.
2. Scan the QR code with an authenticator app, or type in the key shown under it.
3. Enter the code the app shows and select Turn On Two-Factor.
4. Save the 10 backup codes somewhere safe, such as a password manager.

Signing In With It

After you sign in, enter the current code from your app. If you don’t have your phone, enter one of your backup codes instead; each works once. Running low? Make New Backup Codes on the same page replaces them all.

Wrong Codes

Five wrong codes in one sign-in end that attempt, and ten wrong codes in a row lock two-factor sign-in on your account for 15 minutes. This stops anyone from guessing codes.

Turning It Off

Open Two-Factor Sign-In on the Account page and select Turn Off Two-Factor. You may be asked for your password first.

Note

API keys are not affected by two-factor sign-in. Protect them as described in Authentication.