Set up two-step verification and review sessions

Set up an authenticator

The setup is not finished until the verification step succeeds. The app clears the displayed setup key and recovery codes when the dialog closes.

1. Open Security in Account settings and select Set up authenticator.
2. Confirm your current password.
3. Add the displayed setup key to an authenticator app using time-based, six-digit codes with a 30-second interval.
4. Enter a current code and select Verify and enable.
5. Save the recovery codes somewhere private before closing the dialog.

Protect and replace recovery codes

Each recovery code can be used once. At the two-step sign-in screen, choose Use a recovery code instead when you need it. Never include a code or the authenticator setup key in a support report.

Replace recovery codes creates a new set and immediately invalidates the old set. A password reset does not remove two-step verification. If both the authenticator and codes are lost, follow the reviewed recovery contact in the Privacy Policy.

Review active sessions

Security lists active sessions with their start and expiry times. Use Refresh to retrieve the current list. Sign out removes an individual other session; Sign out all devices requires password confirmation and signs out the current device too.

Staff accounts must retain authenticator protection. Session and MFA checks are enforced by the server, not just by the visible buttons.