Authenticator verification
Email-and-password accounts require a code from an authenticator app at sign-in. After confirming your email and signing in for the first time, follow the Set up an authenticator prompt:
- Add the displayed account to your authenticator using the setup key or Open authenticator app link.
- Keep the setup key private.
- Enter the current six-digit code and choose Enable and continue.
At later sign-ins, enter the current code from that app. These codes are generated by your authenticator; they are not sent by text or email. If setup or verification expires, return to sign-in to start again.
Google-created accounts can use Google sign-in. Linking Google to an email-and-password account does not bypass its required password and authenticator verification.
Additional SMS verification
Settings → Security offers an additional SMS verification feature:
- Choose Enable 2FA and confirm your mobile number.
- Enter the code sent to that number.
When this option is enabled, an unfamiliar browser also needs the texted code. Remember this browser skips this additional SMS check for 30 days; it does not skip required authenticator verification.
Avoid losing access
Keep your authenticator available and your SMS number current. If you lose access to either required factor, contact support from your registered email address. Resetting your password does not remove an enabled second factor.
Use a unique password, keep API keys and tokens out of repositories, and revoke any key you suspect is exposed. Sign out of shared machines.