Two-Factor Authentication (2FA)

Two-factor authentication (2FA) requires two proofs of identity to log in:

1. Something you know — your password
2. Something you have — a time-based code from your authenticator app

Even if an attacker has your password, they cannot log in without the time-based code from your device.

1. Install an authenticator app: Google Authenticator, Authy, or 1Password (iOS/Android — free).
2. In XamanProtocol: Dashboard → Settings → Security → Enable 2FA.
3. Scan the QR code with your authenticator app.
4. Enter the 6-digit code shown in the app to confirm setup.
5. Save your backup codes in a secure location — these let you recover access if you lose your device.

After entering your email and password:

1. A second screen asks for your 2FA code.
2. Open your authenticator app and find the XamanProtocol entry.
3. Enter the 6-digit code shown (codes refresh every 30 seconds).
4. You are now logged in.

Codes expire every 30 seconds — if it won't accept the code, wait for the next code cycle.

If you lose your phone or authenticator access:

1. Use a saved backup code to log in and disable 2FA.
2. If you don't have backup codes, contact support. You will need to go through identity verification to regain access.

Always save your backup codes when setting up 2FA.