An authenticator app generates a six digit code that changes every 30 seconds. Any standard app works: Google Authenticator, Microsoft Authenticator, 1Password, Authy, Bitwarden and others.
Setting it up
- Open Profile and start the authenticator app setup.
- Scan the QR code with your app. If you cannot scan, the setup screen also shows the secret as text so you can type it in.
- Your app starts showing a six digit code. Enter the current one to confirm.
- Save the backup codes you are shown next. See below.
The account appears in your app as TenthLoop Portal, labelled with your email address, so it is easy to find among your others.
If the code is rejected
Nearly always the clock. These codes depend on your phone's time matching ours, so if your phone's clock is manually set or drifting, codes fail. Turn on automatic date and time on your phone and try again.
Otherwise, make sure you are typing the current code. They expire every 30 seconds and one that has just rolled over will not work.
Your backup codes
As soon as it is enabled you are shown 10 backup codes. Each works once, in place of your app.
They are shown exactly once and can never be retrieved again. Not by you, and not by us. Save them before you leave that screen: put them in your password manager, or print them and keep them somewhere safe. Do not keep them only on the phone that holds the authenticator app, since that is the one thing likely to go missing.
See Backup codes.
Turning it off
You can disable it from Profile. This also deletes all of your backup codes. If you turn it on again later you get a fresh set, and the old ones stop working.
Changing phones
Before you wipe your old phone, either move the account across in your authenticator app, if it supports that, or disable and re-enable two-factor authentication here so you can scan the QR code on the new device. Doing it in that order avoids needing a backup code at all.