Turn on two-factor authentication

Two-factor authentication (2FA) adds a 6-digit code from an authenticator app to your sign-in, so a stolen password on its own isn't enough to get into your account. It's optional for customers, and it's a setting on your account rather than on any one server. You switch it on from the Account page.

What you need

• An authenticator app on your phone. The setup screen names Google Authenticator, Authy and 1Password.
• A few minutes, and your phone in your hand.

Turn it on

1. Log in and open Account in the dashboard.
2. Under Sign-in and security, find the Two-factor authentication row. It shows Off. Select Enable 2FA.
3. The Set up two-factor authentication window opens on its Scan step. In your authenticator app, add a new account and scan the QR code.
4. If you can't scan it, select the line of characters under "Can't scan it? Enter this setup key in your app." That copies the key, and you can type or paste it into the app instead.
5. Select Continue.
6. On the Verify step, type the 6-digit code your app shows for the account you just added. Codes refresh every 30 seconds. The sixth digit submits the code by itself, or you can select Verify & enable.
7. The row changes to On, with the date it was switched on, and the page says "Two-factor authentication is on."

If the code is wrong you'll see "That code didn't match - try the next one." Wait for the app to show a new code and enter that. Use Back to return to the QR code, or Cancel on the first step to stop. Cancelling leaves 2FA off.

Signing in afterwards

Sign in with your email and password as usual. You're then taken to a Two-factor authentication screen that asks for "the 6-digit code from your authenticator app." Enter it and select Verify.

Codes are based on the time, so if yours keep being refused, check that your phone's clock is set automatically. Authenticator codes are generated from the current time in 30 second steps, as the TOTP standard (RFC 6238) describes.

If you lose your phone

There are no backup codes with our 2FA. If you lose access to your authenticator app and can't sign in, contact us by live chat or email and say it's an account access problem. Contact support and open a ticket lists the routes. Because you can't sign in, the ticket form won't help, so use live chat or support@playyourway.com.au.

Turn it off

1. Open Account, then Sign-in and security.
2. On the Two-factor authentication row, select Turn off 2FA.
3. Confirm in the Turn off two-factor authentication? window. It warns that your account will then only be protected by your password.

The page says "Two-factor authentication is off." If it can't turn 2FA off, it asks you to "Sign out and back in (with your code), then try again."

Good to know

• 2FA belongs to your account, not to a server, so you set it up once.
• To change your password, see Reset or change your account password.
• The Signed-in devices row on the same page lets you sign out every other device with Sign out other devices, which helps if you think someone else has your password.