Set up two-step sign-in

Every account signs in with two things: your password, plus a rotating code generated by an app on your phone. It is switched on for everyone and cannot be turned off, because the same codes also protect your card details.

What you need

Any app that makes time-based codes (TOTP) works, for example Google Authenticator, Microsoft Authenticator, Authy or 1Password.

Connect the app

1. After confirming your email, you land on the two-step sign-in screen.
2. In the authenticator, tap the plus or "add" button and point the camera at the QR code.
3. No camera? Type the setup key shown under the QR code instead. Keep that key private: anyone who has it can make your codes.
4. Type the six-digit code the app now shows and choose Turn it on.

Save your backup codes

Next you see a list of backup codes. Each one signs you in once if your phone is lost or reset.

• Copy them or save them as a text file.
• Keep them offline: on paper, or in a password manager.
• The list appears once and never again. You can make a new set later in Settings, which cancels the old set.

Signing in from now on

Enter your email and password as usual, then the current code from the app. Codes change every 30 seconds, and each code works once.

If the app's codes are refused, check that your phone's clock is set automatically. A clock that is off by a minute or two produces codes the server does not accept.

Lost the phone? See Backup codes and a lost phone.