> For the complete documentation index, see [llms.txt](https://help.fungies.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.fungies.io/workspace-settings/two-factor-authentication.md).

# Two-factor Authentication

Two-factor authentication adds a second step to signing in to your Fungies dashboard. With it on, knowing your password is no longer enough to get into your account - someone also needs a code from your phone.

That matters because your dashboard controls real money and real customer data: your payout details, your orders, your products and your buyers' information. A password on its own is one leaked reuse away from all of it.

Workspace-wide enforcement is not available in the current 2FA rollout.

You will need an authenticator app that supports time-based one-time passwords (TOTP), such as Google Authenticator, 1Password, Authy, or Microsoft Authenticator.

<figure><img src="https://3798839229-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtTjX1Zr5bWzjMleIZro2%2Fuploads%2FHgS12QyCbfaDJa0FUN8e%2Fimage.png?alt=media&amp;token=c7fecf16-35af-405e-a22a-ff364f320b86" alt=""><figcaption></figcaption></figure>

### Before you start: you need a password <a href="#before-you-start-you-need-a-password" id="before-you-start-you-need-a-password"></a>

If you sign in with **Google or Discord and have never set a Fungies password**, you cannot turn on 2FA yet. The setup button is replaced by a prompt to set a password first.

This is not a bug. Turning 2FA on and off requires confirming your password, so the account needs one to exist.

To fix it, click **Set a password** in that panel (or go to the password reset page), set a password, then come back to Account -> Settings. Your Google or Discord sign-in keeps working exactly as before - you are adding a password, not replacing your login method.

### Turning on 2FA <a href="#turning-on-2fa" id="turning-on-2fa"></a>

Go to **Account -> Settings** and find the **Two-factor authentication (2FA)** card, then click **Set up two-factor authentication**.

**Step 1 - Scan the QR code.** Open your authenticator app and scan the code shown. If your app cannot scan - or you are already on your phone - use the **setup key** printed below the QR code instead; **Copy setup key** puts it on your clipboard so you can paste it into the app's manual-entry field.

<figure><img src="https://3798839229-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtTjX1Zr5bWzjMleIZro2%2Fuploads%2FAkfhihkpVyxk7uwf56lA%2Fimage.png?alt=media&amp;token=742121e9-5e39-4d18-a569-bdeefb3b3645" alt=""><figcaption></figcaption></figure>

**Step 2 - Confirm your password.** Enter your current Fungies password. Turning 2FA on signs you out of every other session, so we check it is really you first.

**Step 3 - Enter the 6-digit code.** Type the code your authenticator app is showing, then click **Turn on**. Codes expire every 30 seconds, so enter this one last - if it rolls over while you are typing, just use the next one.

**You will be signed out everywhere else.** Turning 2FA on ends all your other sessions - other browsers, other computers, your phone. You stay signed in where you turned it on. Sign back in elsewhere with your password and a code.

As soon as it is on, you are shown your recovery phrase. Do not skip past it — see the next section.

### Your recovery phrase <a href="#your-recovery-phrase" id="your-recovery-phrase"></a>

The moment 2FA is on, Fungies shows you a **six-word recovery phrase**. This is your way back in if you lose your authenticator app.

**Each recovery phrase is displayed only once.** We store only a hash of the phrase, so we cannot show that phrase again, re-send it, or read it back to you over support. If you close this screen without saving it, it is gone.

Use **Download recovery phrase** to save it as a text file, or **Copy** to paste it into your password manager. Storing it in your password manager is the better habit - a file in your Downloads folder is easy to lose.

Save the recovery phrase shown during setup in a secure place to continue.

<figure><img src="https://3798839229-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtTjX1Zr5bWzjMleIZro2%2Fuploads%2FMUJJRdxbj6bSGA8Mjwlw%2Fimage.png?alt=media&amp;token=a33d75e0-9197-43ed-a16e-f7ac34db52d7" alt=""><figcaption></figcaption></figure>

#### It works once <a href="#it-works-once" id="it-works-once"></a>

The phrase is **single-use**. The moment you sign in with it, it is spent - and you now have no second factor backup at all. After using it, go straight to **Account -> Settings -> Two-factor authentication** and click **Regenerate recovery phrase**.

You can regenerate at any time, not just after using one. Regenerating immediately invalidates the old phrase, so update wherever you stored it.

### Signing in with 2FA on <a href="#signing-in-with-2fa-on" id="signing-in-with-2fa-on"></a>

After your password, you are asked for a **6-digit authentication code** before you reach the dashboard. Open your authenticator app, type the current code, and you are in.

<figure><img src="https://3798839229-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtTjX1Zr5bWzjMleIZro2%2Fuploads%2Fhtxj7NLo7uQeQyme0ZJG%2Fimage.png?alt=media&amp;token=ef37f70b-9114-4640-8e2b-20074493464b" alt=""><figcaption></figcaption></figure>

**Google and Discord sign-ins are challenged too.** Signing in with Google or Discord does not skip the code - the second factor is on your Fungies account, not on your password. This catches people out, so expect it.

#### If you do not have your authenticator <a href="#if-you-do-not-have-your-authenticator" id="if-you-do-not-have-your-authenticator"></a>

On the challenge screen, select *Use your recovery phrase* instead and enter it

<figure><img src="https://3798839229-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtTjX1Zr5bWzjMleIZro2%2Fuploads%2FMzrYQzHDkKpbLUoPixaM%2Fimage.png?alt=media&amp;token=6cca2bbb-7c2f-4969-a8b0-e2e47b1f7366" alt=""><figcaption></figcaption></figure>

Remember it is single-use. Once you are in, regenerate it straight away from Account -> Settings, or you have no backup left.

#### Too many wrong codes <a href="#too-many-wrong-codes" id="too-many-wrong-codes"></a>

Repeated failed attempts from the same network are temporarily blocked. Wait a few minutes and try again. If you are consistently rejected with a code you believe is right, your phone's clock has probably drifted - turn on automatic time sync on the device running your authenticator app, since these codes are generated from the current time.

### Why you are not always asked for a code <a href="#why-you-are-not-always-asked-for-a-code" id="why-you-are-not-always-asked-for-a-code"></a>

You will not see the 6-digit prompt on every single sign-in, and that is intended.

On the challenge screen there is an **I trust this device** checkbox. Tick it and that browser, on that network, is remembered - later sign-ins from it go straight through. Sign in from a **new device or a new IP address** and the code is asked for again.

So: no prompt on your usual laptop is normal. A prompt appearing when you are travelling, on mobile data, or on a new machine is also normal - it means the protection is working.

#### Managing remembered devices <a href="#managing-remembered-devices" id="managing-remembered-devices"></a>

Account -> Settings -> Two-factor authentication has a **Recognized devices** list showing each remembered device with its IP address and when it was last seen. Your current one is marked **This device**.

* Revoke all clears the list → removes saved trust from all recognized devices.
* Revoke → removes saved trust for one device. It does not sign out an existing session; it affects the next sign-in.

Revoke anything you do not recognise, or everything after losing a laptop or phone. Fungies remembers up to 10 devices; past that, the oldest drops off.

### Password resets and email verification <a href="#password-resets-and-email-verification" id="password-resets-and-email-verification"></a>

The code is not only asked for at login. With 2FA on, you are also challenged when you:

* **reset your password** - after clicking the link in the reset email, and
* **verify your email address** - after clicking the link in the verification email.

This closes the obvious way around 2FA: someone with access to your inbox cannot reset your password to take the account, because they still need your second factor.

It does mean that if you have lost your authenticator, a password reset will not get you back in on its own. Use your recovery phrase.

### Turning 2FA off <a href="#turning-2fa-off" id="turning-2fa-off"></a>

Go to **Account -> Settings -> Two-factor authentication** and click **Disable 2FA**.

To turn off 2FA, open Account → Settings and find the Two-factor authentication (2FA) section. You must be signed in and confirm your account password to turn it off.

<figure><img src="https://3798839229-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtTjX1Zr5bWzjMleIZro2%2Fuploads%2FUOfPSZZxNq8Ayih0qi5D%2Fimage.png?alt=media&amp;token=2e7d58fd-b95e-40b5-aa99-844e9282697e" alt=""><figcaption></figcaption></figure>

Disabling removes both the authenticator **and** the recovery phrase from your account, and signs you out of your other sessions. If you turn 2FA back on later, you start fresh: a new QR code and a brand-new recovery phrase.

### If you lose your authenticator and your recovery phrase <a href="#if-you-lose-your-authenticator-and-your-recovery-phrase" id="if-you-lose-your-authenticator-and-your-recovery-phrase"></a>

If you are signed out and lose both your authenticator app and an unused recovery phrase, there is currently no standard admin or support reset for 2FA. Contact support for guidance, but recovery of access cannot be guaranteed.

This is the honest position, and it is why the recovery phrase screen makes you tick a box before continuing.

**So, before you leave this page:**

* Store your recovery phrase in your password manager, not in a downloads folder or a screenshot.
* If you have already used your phrase to sign in, regenerate it now - a spent phrase is not a backup.
* If your authenticator app supports an encrypted cloud backup, turn it on. Most do.

If you have lost your authenticator but **still have your recovery phrase**, you are fine: sign in with the phrase, then regenerate it. If you have lost the phrase but **still have your authenticator**, you are also fine: sign in as normal and regenerate the phrase from Account -> Settings.

It is only losing *both* that is unrecoverable.

***

**Still stuck?** Contact support with your workspace name and the email on your account. We can help with anything except bypassing the second factor itself.