Skip to main content

Two-Factor Authentication

Two-factor authentication (2FA) adds a second lock to your account: after your password, you also enter a 6-digit code from an authenticator app on your phone. Even if someone learns your password, they can't sign in without your device.

Onflow Ads uses the standard TOTP ("time-based one-time password") system, so it works with Google Authenticator or any similar authenticator app (Authy, Microsoft Authenticator, 1Password, and so on).

Before you start

You need a verified email on your account, and an authenticator app installed on your phone.

Turning 2FA on​

  1. Sign in and go to https://onflowads.com/account.
  2. Open the Security tab.
  3. Click Enable two-factor.
  4. A setup panel appears with a QR code. Scan it with your authenticator app — or, if you can't scan, type the manual key shown next to it into your app instead.
  5. Save your recovery codes. The panel shows 10 recovery codes. Copy them somewhere safe (a password manager is ideal). They are shown only once.
  6. Enter the current 6-digit code from your app in the confirmation field and click Turn on 2FA.

You'll see "Two-factor is on", and we send a confirmation email to your address. If the setup panel sits unconfirmed for too long it expires — just click Enable two-factor again to restart (a fresh QR code and fresh recovery codes are generated).

Signing in with 2FA​

With 2FA on, sign-in gains a second step:

  1. Enter your email and password as usual and click Sign in.
  2. The page switches to an Authentication code field.
  3. Enter the 6-digit code from your app and click Verify and sign in.

You get 5 attempts per sign-in; too many wrong codes locks sign-in for 6 hours as an anti-guessing protection.

Recovery codes — your backup key​

Each recovery code is a one-time replacement for an app code. If your phone is lost, broken or reset:

  • At the 2FA step of sign-in, enter a recovery code instead of an app code.
  • Each code works exactly once — after use it's gone.

To get a fresh set at any time:

  1. Go to Account → Security.
  2. Click Regenerate recovery codes.
  3. Enter a current code from your app (or an unused recovery code) to confirm.
  4. Save the new set — regenerating replaces all previous recovery codes.
Don't lose both

If you lose your authenticator device and have no recovery codes left, you will not be able to pass the 2FA step. Store recovery codes somewhere you'll still have if your phone disappears.

Turning 2FA off​

  1. Go to Account → Security.
  2. Click Disable 2FA.
  3. Enter a current code from your app (or a recovery code) and confirm.

You'll see "Two-factor disabled" and receive a confirmation email. Your account goes back to password-only sign-in.

What else 2FA protects​

Beyond sign-in, sensitive account changes also ask for your 2FA code. For example, changing your email address requires your current password and a 2FA code when 2FA is on.

Keeping your account secure — a quick checklist​

  • Turn on 2FA. It's the single biggest upgrade to your account's safety.
  • Use a unique password you don't use anywhere else, stored in a password manager.
  • Keep your recovery codes somewhere safe and separate from your phone.
  • Sign out on shared computers, and skip "Remember me" on devices that aren't yours.
  • Watch for confirmation emails. We email you when 2FA is enabled or disabled — if you get one you didn't trigger, reset your password immediately.
  • Onflow Ads will never ask for your password or 2FA codes by email or chat.

Next: Account settings and profile — the page the Security tab lives on, alongside your profile, email and wallet.