> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sandywp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Two-factor authentication

> Ask for a code from an authenticator app every time you log in to SandyWP in a browser.

Two-factor authentication (2FA) adds a second step to every browser login. After your password, or after Google or GitHub sign-in, SandyWP asks for a 6-digit code from an authenticator app on your phone.

It works with any app that supports time-based codes (TOTP), such as Google Authenticator, 1Password, Authy, Bitwarden or Microsoft Authenticator.

## Turn it on

**1. Open Security**

Open the profile menu, select **Account**, and then choose the **Security** tab.

**2. Scan the QR code**

Select **Turn on two-factor**, then scan the QR code with your authenticator app. If you can't scan it, type the key shown under the code into the app.

**3. Confirm with a code**

Enter the 6-digit code the app shows and select **Turn on**.

**4. Save your recovery codes**

SandyWP shows 10 recovery codes once. Copy or download them and keep them somewhere safe, such as your password manager.

## Log in with 2FA on

Log in as usual. SandyWP then asks for the current code from your authenticator app. Each code works once.

Lost your phone? Select **Use a recovery code** on the code step and enter one of your recovery codes. Each recovery code works once.

## Recovery codes

The **Security** tab shows how many recovery codes you have left. To replace them all with a fresh set, enter a code from your app or a recovery code and select **New recovery codes**. The old codes stop working.

## Turn it off

On the **Security** tab, enter a code from your app or a recovery code and select **Turn off**.

## API keys, the CLI and AI connectors

[API keys](/guides/api-keys.md), the [CLI](/cli.md) and MCP connectors do not ask for a code. They are separate credentials, and you can only create or approve them from a browser session that already passed 2FA. Revoke any you no longer use from the **API keys** tab.

> [!NOTE]
>
> If you lose both your phone and your recovery codes, contact support from the **Support** tab to get back into your account.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.