Set up at /console/account/two-factor/. Both methods are supported and you can enrol both.
Do this if you have servers
Whoever holds your portal password can read the root password of every server on the account and destroy any of them.
Authenticator app (TOTP)
- Open the two-factor page and start enrolment.
- Scan the QR code with any authenticator app.
- Enter a code to confirm. Enrolment is not finished until you do. Opening the page and walking away leaves you exactly as you were, which is on purpose: a half-finished setup must not lock you out.
- Save the recovery codes it shows you.
Passkeys
A passkey uses your device's own authentication, a fingerprint, a face, or a hardware key. Register one from the same page.
A passkey is a second factor here, not a password replacement
Sign-in is always email and password first. There is no passwordless sign-in on this platform. If the account has a passkey, the second step leads with it, and still offers your authenticator app or a recovery code if the passkey is unavailable. Cancelling the passkey prompt does not throw the sign-in away.
Adding or removing a passkey asks for your password again.
Recovery codes
Shown once, at enrolment. Each works once. They live on the account rather than on a device, so a passkey-only account still has a way back in.
Store them somewhere that is not the phone with the authenticator on it. A password manager or a printed copy both work; a screenshot in the phone's camera roll defeats the point.
Regenerate them from the two-factor page if you think they have been seen. Doing so invalidates the old set.
Locked out
- Lost the phone, have the codes: sign in with a recovery code, then enrol a new device.
- Lost both: open a ticket. Staff can reset the second factor after verifying you own the account. There is no self-service path, because one would be a way around the second factor.
Signing in with the second factor
After the password you land on /account/two-factor/. The challenge has its own attempt limit, and hitting it cancels the sign-in entirely rather than leaving something to keep guessing at.