Two-step verification (2FA)
Turn on two-step verification yourself from the Security tab, save your backup codes and use the six-digit code when you sign in.
Two-step verification (2FA) adds a temporary six-digit code to sign-in, on top of your password: even if someone gets your password, they can't get in without your phone. You turn it on and manage it yourself from Settings → Security.
Turning it on
Avatar in the sidebar → Settings → Security tab. In the Two-step verification section, click Turn on and follow the steps:
Confirm your password. Type it in the Confirm your password field and click Continue (while it works, "One moment…"). Cancel takes you back to the start.
Scan the QR code with your authenticator app (Google Authenticator, 1Password, Authy…). If you can't scan it, click I can't scan the code to see the key so you can type it in by hand. Then enter the 6-digit code shown in the app and click Verify.
Save your backup codes. The app shows you a list of codes: they are your only way in if you lose your phone, they're shown only once and each one works for a single sign-in. Click Download as a file to keep them, tick "I've saved my backup codes somewhere safe" and click Finish.
When you're done you'll see "Done. Next time you sign in we'll ask for the code.", and the section shows the On status.
The QR code is generated in your own browser: the secret key is never sent to an external service.
Once verification is on
The same tab has two buttons:
- Regenerate backup codes — asks for your password and generates a new list. The previous codes stop working. Save the new list just like the first one.
- Turn off — asks for your password and turns two-step verification off.
If the password is wrong, you'll see "That password isn't correct."; if the six-digit code fails while turning it on, "That code isn't valid. Check your phone's clock and try again."
While it's on, changing your password on the Account tab also asks for the TOTP code (6 digits) (see Personal details, password, and sessions), and you can't sign in with Continue with Google: you'll need to sign in with your email and password.
The verification step at sign-in
With verification on, after you type your password you'll see the Two-step verification screen, which asks for the Authenticator code (6 digits):
- Open your authenticator app and copy the current AreaCacao code.
- Enter it in the field and click Verify and continue (while it validates, "Verifying…").
Compatible apps: Google Authenticator · 1Password · Authy · Microsoft Authenticator.
If you can't access the app
On the verification step, click "Can't access your app? Use a backup code" and enter one of your backup codes. Each code is single-use. To return to the normal mode, use "Use authenticator app".
If you want to start sign-in over from the beginning, click "← Back to sign in" to go back to the email and password step.
If you lose your phone and your backup codes too, you won't be able to complete sign-in. Email us at support@areacacao.com from your account's email address.
More ways to protect your account
- Use a long, unique password (at least 8 characters; the more, the better). See change password.
- If you suspect someone else has access, sign out of all sessions.
- Don't reuse the password on other services.