Two-factor recovery codes

Your phone is in for repair, and the authenticator app went with it. Getting back into your account used to start with a support ticket.

The enemy is a lost phone that locks you out of your own funnels.

Turning on two-factor authentication now gives you 10 recovery codes to copy or download. Each one signs you in once in place of the app code, from Other ways to sign in on the sign-in page. We e-mail you whenever one is used, the Two factor screen warns you when 3 or fewer are left, and Create new codes swaps the whole set for a fresh one after you enter a code from your app.

Some changes now need two-factor authentication turned on: connecting a payment gateway, inviting a team member, adding a custom domain and publishing a checkout page. If it is off when you try one, the app sets it up with you and then finishes what you started. Creating or showing an API key and connecting the CLI also ask for a fresh code from your app, which stays valid for 10 minutes. Keys and CLI logins you already have keep working.

Two-factor authentication will become required for every account. Before it applies to yours, a reminder after sign-in tells you the date, and brand owners see which team members have not turned it on yet.

Try it: open Account settings, Two factor, and click Enable two-factor authentication.