Drıftstack docs
Docs

Set up two-factor authentication (authenticator app, recovery codes)

You might be here because: “how do I turn on 2FA” · “enable two factor” · “QR code won’t scan” · “it asks for my password when setting up two-factor and I signed up with Google” · “where are my recovery codes” · “can I set up 2FA from the desktop app” · “the code from my app is rejected during setup” · “add authenticator” · “turn on 2fa”

Short answer

In the web dashboard, open Security → Two-factor authentication → Set up two-factor authentication. Scan the QR code (or type the setup key) into any authenticator app, enter your current password, then the 6-digit code from the app to confirm. You then get 10 recovery codes shown once — save them. From then on dashboard sign-in asks for a code as well as your password.

Check first

  • Use the web dashboard. Two-factor changes need an interactive web session; the desktop app and API keys cannot enroll, disable or regenerate codes.
  • Phone clock roughly correct? Time-based codes drift with a wrong clock.
  • Using the code from the new entry you just added, not an older one?

Likely causes and fixes

  1. “Turning on two-factor needs your password” but you signed up with Google/GitHub and never set one. Leave the password field empty — it works if you signed in within the last 10 minutes. Otherwise sign out, sign in again, and retry.

  2. QR will not scan. Type the Setup key shown next to the QR into the app manually; it works with any app using its standard settings.

  3. “Could not verify that code.” Wait for the next code and try once more. If the page timed out, check the status badge: if two-factor now shows as enrolled, your recovery codes were not shown — regenerate them now while you still have the app. If it shows not enrolled, start setup again.

  4. Recovery codes. Shown once, each works once; use Copy all or Download .txt and store them safely. You can see how many remain and regenerate a fresh set later (old ones are invalidated immediately).

  5. Disabling. Security → Disable two-factor; you are asked for a fresh code to confirm, and all recovery codes are cancelled.

  6. Two-factor endpoints say “Feature unavailable”. Two-factor is not enabled on this deployment. Not something you can change; ask support.

If it still fails

Press Talk to a person in this chat (or open Help) and include: account email, the step you are on, the exact message, and whether you signed up with a password or a linked sign-in. Never send codes or the setup key. Account-access problems (locked out, lost app) are handled by a person — see Lost my authenticator app or recovery codes.