Turn it on
1
Open Security
Open the profile menu, select Account, and then choose the Security tab.
2
Scan the QR code
Select Turn on two-factor, then scan the QR code with your authenticator app. If you can’t scan it, type the key shown under the code into the app.
3
Confirm with a code
Enter the 6-digit code the app shows and select Turn on.
4
Save your recovery codes
SandyWP shows 10 recovery codes once. Copy or download them and keep them somewhere safe, such as your password manager.
Log in with 2FA on
Log in as usual. SandyWP then asks for the current code from your authenticator app. Each code works once. Lost your phone? Select Use a recovery code on the code step and enter one of your recovery codes. Each recovery code works once.Recovery codes
The Security tab shows how many recovery codes you have left. To replace them all with a fresh set, enter a code from your app or a recovery code and select New recovery codes. The old codes stop working.Turn it off
On the Security tab, enter a code from your app or a recovery code and select Turn off.API keys, the CLI and AI connectors
API keys, the CLI and MCP connectors do not ask for a code. They are separate credentials, and you can only create or approve them from a browser session that already passed 2FA. Revoke any you no longer use from the API keys tab.If you lose both your phone and your recovery codes, contact support from the Support tab to get back into your account.