Two-factor authentication

TOTP second factor with single-use recovery codes; mandatory for admins and resellers, optional for customers.

Used by

Everyone who signs in

Plan

Free

Status

Available

Category

Access and accounts

What it is

A time-based one-time code (TOTP, RFC 6238) from any authenticator app, asked after the password. Setting it up shows recovery codes, each valid once. A code that was already used is rejected, and failed attempts lock the account for a while.

What it is for

Keeping an administrator or reseller account safe when a password leaks, and letting customers protect their own login.

Limits

It is mandatory for administrators and resellers and optional for customers. A person who loses the device uses a recovery code; an administrator can regenerate the second factor of an account, and whoever does it writes their own password for that. API tokens never carry or set a second factor.