Two-factor

With two-factor on, a password on its own is not enough to reach your orders. A six-digit code stands between the two.

Turning it on

Settings, then Security. The card is Two-factor authentication and it offers two methods. Only one can be on at a time — to move from one to the other, turn the current one off first.

1. Authenticator app

   Press Set up authenticator app. Scan the QR code with 1Password, Google Authenticator, Authy or any app that does six-digit codes, then type the code it shows and press Turn on.

2. SMS codes

   Needs a phone number saved on your profile first — the card says so if yours is blank. Press Set up SMS codes, wait for the text, type the code, press Turn on. Doing this also marks that number verified.

Signing in with it on

The code screen is the same whichever door you used — password, Continue with Google, or an emailed link. None of the three is a way past it, and no session is created until the code checks out.

An authenticator code changes every 30 seconds, and the code either side of the current one is accepted, so a phone whose clock is a few seconds out still gets you in. With SMS codes there is a Resend code link under the field if the text is slow.

The screen itself lasts five minutes. Leave it longer and it tells you the sign-in request expired and sends you back to the start — the password again, then a fresh code.

Resetting your password does not switch two-factor off. The code screen still comes after it. See If you forget your password.

If you lose the device

Turning two-factor off asks for a current code from the method that is on: one from the authenticator, or one freshly texted to the number on your profile. There is no other switch. Nobody else in your dashboard can lift it for you — not the owner, not a manager — because the control only ever acts on the account that is signed in.

So the two things that get you back in are both things you arrange in advance.

• Authenticator app. The setup key you copied. Type it into the app on the new phone and it produces the same codes the old one did.
• SMS codes. The number, not the handset. A replacement phone with the same number receives the same texts.

If you are about to change phone number, turn two-factor off while you can still produce a code, then turn it on again once the new number is saved on your profile.