Two-factor authentication
Two-factor authentication adds a second proof at sign-in: a rotating six-digit code from an authenticator app such as Google Authenticator, 1Password, or Authy. It is worth enabling on any account that can spend credits.
Enroll an authenticator app
- Go to Settings → Two-factor authentication and select Set up authenticator.
- Scan the QR code with your app. If the device cannot scan, copy the secret shown under the code and enter it by hand.
- Type the six-digit code your app displays, then select Enable two-factor.
The card then shows an On badge and lists the authenticator with the date it was added. Add another enrolls a second app, and the trash icon removes one.
What sign-in looks like afterwards
After you enter your email code, the console shows a second screen asking for the code from your authenticator app. Enter the six digits to finish signing in. If you have more than one authenticator enrolled, a code from any of them is accepted — the console tries each enrolled factor.
If you have a passkey registered, that screen also offers Use a passkey instead.
Recovery
Superheat does not issue printed recovery codes. Recovery means having a second factor you can still reach.
| Situation | What to do |
|---|---|
| Phone lost, a second authenticator enrolled | Enter a code from the other app |
| Phone lost, a passkey registered | Choose Use a passkey instead on the second screen |
| Still signed in somewhere | Remove the old authenticator in Settings, then set up a new one |
The console has no way to restore access once every enrolled factor is gone. Before you rely on a single phone, register a passkey or enroll a second authenticator app.
What a stepped-up session means
Your session begins at the first factor, the six-digit email code. When you have a factor enrolled, the console asks for it before it hands you the dashboard; answering it steps the session up.
The step-up applies to the browser session you are in. Signing out, or signing in from another browser or device, means the second factor is requested again. Enrolling and removing factors happens in Settings, which needs a signed-in session.
API keys are a separate credential and are unaffected: they are rejected on account endpoints and on every admin action, so turning on two-factor does not change anything for scripts that use one.