Securing Your Account with 2FA

Two-factor authentication (2FA) adds a second, time-limited factor to every sign-in: after your password, the store asks for a 6-digit code from an authenticator app such as Google Authenticator, Authy or Aegis. Once it is enabled, a leaked password alone is no longer enough to get into your account — which matters, because your account is where your licenses and order history live. 2FA is optional but strongly recommended, and the whole setup happens on the Security card of your dashboard.

#Enabling 2FA

1. Sign in and open your dashboard, then scroll to the Security card.
2. Click Activate two-factor and enter your account password to confirm it is really you.
3. A QR code appears — open your authenticator app and scan it. Cannot scan? Copy the displayed setup key and add it to the app manually as a time-based entry.
4. Enter the current 6-digit code from the app to complete the activation.
5. The store now shows your backup codes — save them immediately (see below). Two-factor authentication is active from this moment: every future sign-in asks for your password and a current code.

#Backup codes

When you activate 2FA you receive 10 single-use backup codes, each formatted like 3F9K-7QD2. Any one of them can be entered instead of the authenticator code at sign-in, which is exactly what saves you when your phone is lost, wiped or out of battery. Each code works once and is then consumed.

Store them somewhere safe and offline — a password manager vault or a printed note in a drawer, not a screenshot in your camera roll. The Security card always shows how many unused backup codes you have left, and a fresh set can be generated from a trusted device when you are running low.

#Signing in with 2FA

The sign-in flow itself stays simple: enter your email and password as usual, and the store then presents the two-factor step. Enter the current 6-digit code from your authenticator app — or one of your backup codes if the app is unavailable. If a code is rejected, wait for the next 6-digit window and try again; codes rotate every 30 seconds and a failed challenge is single-use, so simply start the sign-in again.

#Losing your authenticator

Lost the device but still have backup codes? Sign in with any unused backup code, then regenerate a fresh set and re-enrol your new phone from the Security card. Lost the device and the codes? Contact the team — open a ticket as described in Contacting Support, and account recovery will be handled personally with ownership checks.

#Disabling 2FA

You can turn 2FA off from the same Security card: enter your account password (a current authenticator code is optional) and click Disable two-factor. Only do this from a device you trust. If you later re-enable it, you will be issued a new secret and a fresh set of 10 backup codes — old codes from the previous enrolment do not come back.