Two-factor authentication
Two-factor authentication adds a second proof at sign-in: a rotating six-digit code from an authenticator app such as Google Authenticator, 1Password, or Authy. It is worth enabling on any account that can spend credits.
Enroll an authenticator app
- Go to Settings → Two-factor authentication and select Set up authenticator.
- Scan the QR code with your app. If the device cannot scan, copy the secret shown under the code and enter it by hand.
- Type the six-digit code your app displays, then select Enable two-factor.
The card then shows an On badge and lists the authenticator with the date it was added. Add another enrolls a second app, and the trash icon removes one.
What sign-in looks like afterwards
After you enter your email code, or come back from Google or GitHub, the console shows a second screen asking for the code from your authenticator app. Enter the six digits to finish signing in. Use a different account on that screen signs you out instead. If you have more than one authenticator enrolled, a code from any of them is accepted — the console tries each enrolled factor.
The authenticator app is the only second factor the console accepts. Passkeys are not available yet.
Recovery
Superheat does not issue printed recovery codes. Recovery means having a second factor you can still reach.
| Situation | What to do |
|---|---|
| Phone lost, a second authenticator enrolled | Enter a code from the other app |
| Still signed in somewhere | Remove the old authenticator in Settings, then set up a new one |
The console has no way to restore access once every enrolled factor is gone. Before you rely on a single phone, use Add another to enroll a second authenticator app on a device you keep separately, such as a second phone or a password manager like 1Password.
What a stepped-up session means
Your session begins at the first factor — the six-digit email code, or Google or GitHub. When you have a factor enrolled, the console asks for it before it hands you the dashboard; answering it steps the session up.
The API enforces the same rule on its own. A session token of an account with an enrolled factor is refused with 403 MFA_REQUIRED until the session has stepped up, whichever app sent it, and the console answers that by sending you to the second-factor screen.
The step-up applies to the browser session you are in. Signing out, or signing in from another browser or device, means the second factor is requested again. Enrolling and removing factors happens in Settings, which needs a signed-in session.
API keys are a separate credential and are unaffected: they are rejected on account endpoints and on every admin action, so turning on two-factor does not change anything for scripts that use one.