Two-factor Authentication
Two-factor authentication adds a second step to signing in to your Fungies dashboard. With it on, knowing your password is no longer enough to get into your account - someone also needs a code from your phone.
That matters because your dashboard controls real money and real customer data: your payout details, your orders, your products and your buyers' information. A password on its own is one leaked reuse away from all of it.
Workspace-wide enforcement is not available in the current 2FA rollout.
You will need an authenticator app that supports time-based one-time passwords (TOTP), such as Google Authenticator, 1Password, Authy, or Microsoft Authenticator.
Before you start: you need a password
If you sign in with Google or Discord and have never set a Fungies password, you cannot turn on 2FA yet. The setup button is replaced by a prompt to set a password first.
This is not a bug. Turning 2FA on and off requires confirming your password, so the account needs one to exist.
To fix it, click Set a password in that panel (or go to the password reset page), set a password, then come back to Account -> Settings. Your Google or Discord sign-in keeps working exactly as before - you are adding a password, not replacing your login method.
Turning on 2FA
Go to Account -> Settings and find the Two-factor authentication (2FA) card, then click Set up two-factor authentication.
Step 1 - Scan the QR code. Open your authenticator app and scan the code shown. If your app cannot scan - or you are already on your phone - use the setup key printed below the QR code instead; Copy setup key puts it on your clipboard so you can paste it into the app's manual-entry field.
Step 2 - Confirm your password. Enter your current Fungies password. Turning 2FA on signs you out of every other session, so we check it is really you first.
Step 3 - Enter the 6-digit code. Type the code your authenticator app is showing, then click Turn on. Codes expire every 30 seconds, so enter this one last - if it rolls over while you are typing, just use the next one.
You will be signed out everywhere else. Turning 2FA on ends all your other sessions - other browsers, other computers, your phone. You stay signed in where you turned it on. Sign back in elsewhere with your password and a code.
As soon as it is on, you are shown your recovery phrase. Do not skip past it — see the next section.
Your recovery phrase
The moment 2FA is on, Fungies shows you a six-word recovery phrase. This is your way back in if you lose your authenticator app.
Each recovery phrase is displayed only once. We store only a hash of the phrase, so we cannot show that phrase again, re-send it, or read it back to you over support. If you close this screen without saving it, it is gone.
Use Download recovery phrase to save it as a text file, or Copy to paste it into your password manager. Storing it in your password manager is the better habit - a file in your Downloads folder is easy to lose.
Save the recovery phrase shown during setup in a secure place to continue.
It works once
The phrase is single-use. The moment you sign in with it, it is spent - and you now have no second factor backup at all. After using it, go straight to Account -> Settings -> Two-factor authentication and click Regenerate recovery phrase.
You can regenerate at any time, not just after using one. Regenerating immediately invalidates the old phrase, so update wherever you stored it.
Signing in with 2FA on
After your password, you are asked for a 6-digit authentication code before you reach the dashboard. Open your authenticator app, type the current code, and you are in.
Google and Discord sign-ins are challenged too. Signing in with Google or Discord does not skip the code - the second factor is on your Fungies account, not on your password. This catches people out, so expect it.
If you do not have your authenticator
On the challenge screen, select Use your recovery phrase instead and enter it
Remember it is single-use. Once you are in, regenerate it straight away from Account -> Settings, or you have no backup left.
Too many wrong codes
Repeated failed attempts from the same network are temporarily blocked. Wait a few minutes and try again. If you are consistently rejected with a code you believe is right, your phone's clock has probably drifted - turn on automatic time sync on the device running your authenticator app, since these codes are generated from the current time.
Why you are not always asked for a code
You will not see the 6-digit prompt on every single sign-in, and that is intended.
On the challenge screen there is an I trust this device checkbox. Tick it and that browser, on that network, is remembered - later sign-ins from it go straight through. Sign in from a new device or a new IP address and the code is asked for again.
So: no prompt on your usual laptop is normal. A prompt appearing when you are travelling, on mobile data, or on a new machine is also normal - it means the protection is working.
Managing remembered devices
Account -> Settings -> Two-factor authentication has a Recognized devices list showing each remembered device with its IP address and when it was last seen. Your current one is marked This device.
Revoke all clears the list → removes saved trust from all recognized devices.
Revoke → removes saved trust for one device. It does not sign out an existing session; it affects the next sign-in.
Revoke anything you do not recognise, or everything after losing a laptop or phone. Fungies remembers up to 10 devices; past that, the oldest drops off.
Password resets and email verification
The code is not only asked for at login. With 2FA on, you are also challenged when you:
reset your password - after clicking the link in the reset email, and
verify your email address - after clicking the link in the verification email.
This closes the obvious way around 2FA: someone with access to your inbox cannot reset your password to take the account, because they still need your second factor.
It does mean that if you have lost your authenticator, a password reset will not get you back in on its own. Use your recovery phrase.
Turning 2FA off
Go to Account -> Settings -> Two-factor authentication and click Disable 2FA.
To turn off 2FA, open Account → Settings and find the Two-factor authentication (2FA) section. You must be signed in and confirm your account password to turn it off.
Disabling removes both the authenticator and the recovery phrase from your account, and signs you out of your other sessions. If you turn 2FA back on later, you start fresh: a new QR code and a brand-new recovery phrase.
If you lose your authenticator and your recovery phrase
If you are signed out and lose both your authenticator app and an unused recovery phrase, there is currently no standard admin or support reset for 2FA. Contact support for guidance, but recovery of access cannot be guaranteed.
This is the honest position, and it is why the recovery phrase screen makes you tick a box before continuing.
So, before you leave this page:
Store your recovery phrase in your password manager, not in a downloads folder or a screenshot.
If you have already used your phrase to sign in, regenerate it now - a spent phrase is not a backup.
If your authenticator app supports an encrypted cloud backup, turn it on. Most do.
If you have lost your authenticator but still have your recovery phrase, you are fine: sign in with the phrase, then regenerate it. If you have lost the phrase but still have your authenticator, you are also fine: sign in as normal and regenerate the phrase from Account -> Settings.
It is only losing both that is unrecoverable.
Still stuck? Contact support with your workspace name and the email on your account. We can help with anything except bypassing the second factor itself.
Last updated