Two-factor Authentication

Two-factor authentication (2FA) adds a time-based one-time code to your password. After a successful password sign-in, Conduit asks for a 6-digit code from your authenticator app before it grants access. Google Authenticator, Authy and 1Password are examples of such an app.

Enable 2FA

  1. Open the user menu and go to Two-factor auth (/app/settings/account/2fa).
  2. Click Set up two-factor authentication.
  3. Scan the QR code with your authenticator app, or copy the manual key into the app.
  4. Enter the current 6-digit code from the app to complete the setup.
  5. Conduit shows 8 single-use backup codes. Save them now. Conduit shows them one time only. You can copy all the codes, download them as a text file, or both.

From this point, every sign-in needs both your password and a new authenticator code.

If you sign in through Google or GitHub OAuth, the OAuth provider handles the authentication, and Conduit does not ask for a 2FA code in that flow. 2FA still protects the sign-ins that use a password.

Backup codes

A backup code lets you sign in when you lose access to your authenticator device. Each code works one time and then becomes invalid.

The Two-factor auth page shows how many codes remain. When few codes remain, generate a new set:

  1. Open the user menu and go to Two-factor auth.
  2. Expand Regenerate backup codes.
  3. Enter a current authenticator code.
  4. Click Regenerate backup codes. The previous set becomes invalid, and Conduit shows a new set of 8. Save them in the same way as the first set.

Using 2FA on sign-in

After Conduit accepts your password, it opens the 2FA challenge page. Enter one of these:

  • a current 6-digit authenticator code, or
  • one of your unused backup codes, in the format XXXXX-XXXXX.

CAUTION: A backup code is consumed even when the sign-in fails for another reason, for example an expired session in the middle of the flow. If Conduit asks again, use a different code.

Lost your authenticator device

If you still have backup codes:

  1. Sign in with a backup code at the 2FA prompt.
  2. Set up a new authenticator on a new device (see Enable 2FA). This rotates the TOTP secret.
  3. Generate new backup codes, so that the old set becomes invalid.

If you have no backup codes and no access to the authenticator, contact Conduit support to recover the account. There is no self-service override.

Disable 2FA

  1. Go to Settings → Two-factor auth.
  2. Expand Disable two-factor authentication.
  3. Enter a current authenticator code or a backup code.
  4. Click Disable 2FA.

The disable action clears the TOTP secret and all unused backup codes. If you enable 2FA later, the setup starts again from the beginning.

Next steps

  • Account Settings. Password, timezone, account deletion.
  • API Tokens. Programmatic access does not use 2FA, so treat a token with the same care.