Your own two-factor login
Setting up and replacing the second factor the console asks for. This is about your own account only — no role lets you change anybody else's.
Every admin, whatever their roles, and every admin needs it: on production a second factor is required, so this page is the last step of getting set up rather than an optional extra.
Before you start
- · An authenticator app on your phone — any of the standard ones will do.
Steps
- 1
Open Settings → Two-factor login ①.
You should see · Your current state — either enrolled, or an invitation to enrol.
What it means · If you signed in and found yourself here unable to reach anything else, nothing is broken. This page stays open to un-enrolled admins on purpose; the rest of the console does not.
- 2
Start enrolment and scan the code with your authenticator.
You should see · A QR code with the same secret spelled out underneath, then a field asking for the first six-digit code to prove it worked.
What it means · Scanning and confirming are two steps, and only the confirmation finishes it. Walking away after the scan leaves you un-enrolled with an entry sitting in your authenticator that does not work yet.
⚠ Save the typed key or your authenticator's own backup before you leave this page.
- 3
Make sure you can get back in if you lose the phone.
You should see · The typed key shown beside the QR code is what you keep.
What it means · There is no self-service reset. If the phone goes and you kept nothing, a super admin has to clear your factor before you can sign in again — and if you ARE the only super admin, that is a genuinely bad afternoon.
How to tell it worked
- ✓This page reports that a second factor is enrolled.
- ✓Signing out and back in asks for a code, and the code works.
Problems
The first code you enter is rejected
Why · Either the phone clock has drifted, or the code was typed as its window ran out.
Fix · Let the authenticator roll over and use the next code. If it keeps failing, check the phone is set to network time.
You scanned the code but the console still says you are not enrolled
Why · The confirmation step was never completed — scanning alone does not enrol you.
Fix · Start again and enter the six-digit code when asked. Delete the half-finished entry from your authenticator first so you do not pick the wrong one later.
You replaced your phone
Why · The secret lived on the old device.
Fix · If you kept the typed key, add it to the new authenticator by hand. If not, a super admin has to reset you.