Turning on two-factor authentication
An authenticator-app code at every sign-in, and a code to confirm a revenue withdrawal. Set up under My Profile → Security; keep the recovery codes somewhere safe.
What it protects
With two-factor authentication on, a password alone cannot open your account: every sign-in asks for a six-digit code from an authenticator app on your phone, and a revenue withdrawal asks for a code before it is submitted. It applies to your profile; every team member turns it on for themselves.
Turning it on
Under My Profile → Security, choose Turn on two-factor authentication. Scan the QR code with an authenticator app, or type the key into the app by hand, then enter the code it shows. The console confirms, and shows your recovery codes once.
Recovery codes
Each recovery code signs you in a single time without the app. Store them where you store passwords, not in your email. If you lose the app and the codes, contact support from the email address on your account; expect to prove who you are before the team removes the second factor.
Turning it off, or moving phones
Under Security you can turn two-factor authentication off with a current code, or turn it off and on again to enrol a new phone. Sign-in alerts tell you by email when your account is signed into from a new device, and Active sessions lets you sign any session out.
When a code is refused
Authenticator codes change every thirty seconds and are only valid for a short window either side. If a code is refused, wait for the next one and try again, and check that the phone's clock is set automatically: a clock that is a minute out produces codes the server will not accept. A code that was already used in the same window is refused too. If every code fails, use a recovery code to sign in, then turn two-factor authentication off and on again to enrol the app afresh.
For your team
Each member of your business unit sets this up on their own profile; an owner cannot turn it on for someone else, and a seat without it is a seat protected by a password alone. Ask every member with access to money, members or publishing to enrol, and keep in mind that a revenue withdrawal is confirmed with the code of the person submitting it.
Steps
- Open My Profile, then Security.
- Choose Turn on two-factor authentication.
- Scan the QR code with an authenticator app (Google Authenticator, 1Password, Authy or similar), or type the key into it.
- Enter the six-digit code the app shows to confirm.
- Save the recovery codes. They are shown once; each one signs you in a single time if you lose the app.