Skip to content

Account & Security Updated 2026-07-22

Set up two-factor authentication

Turn on two-factor authentication for your Stack Harbor console account using an emailed code or an authenticator app (TOTP).

Two-factor authentication (2FA) asks for a one-time code in addition to your password each time you sign in, so a stolen password alone isn’t enough to reach your account.

Where to find it

Account → Security → Two-Factor Auth. A green banner at the top tells you the current state — for example, “Two-Factor Authentication is enabled via Email.”

The two methods

Under Available methods, pick the one that fits how you sign in:

  • Email — the console emails a 6-digit code to your sign-in address at each sign-in. The method in use is marked Currently active.
  • Authenticator app — generate a 6-digit code offline with any TOTP app, such as Authy, 1Password, Google, or Proton. Choose Switch to this to move to it.

Which method should you pick

  • Authenticator app is the safer default: the code is generated on your device and works even without a network connection.
  • Email needs no extra app and is fine as a starting point, but it’s only as strong as the security on your inbox.

Switch methods

  1. On the method you want, click Switch to this — the active method shows Currently active in place of a button.
  2. Follow the prompts to finish setup. For an authenticator app, that generally means scanning a code with your app and entering the 6-digit code it shows to confirm the pairing.
  3. Once confirmed, that method becomes active and the banner at the top updates.

Turn it off

The Turn off two-factor authentication card removes the extra step. As it notes, you’ll confirm your password first, and you can re-enable any method anytime. Click Disable and confirm your password to proceed.

Good to know

  • The console states it plainly: it never turns multi-factor off automatically — you choose when to enable, switch, or disable it.
  • If you lose access to your method — a new phone, a wiped authenticator app, or an inbox you can’t reach — contact support to regain access to your account. Where your authenticator app offers backup or recovery codes, keeping them somewhere safe saves you that round-trip.
  • Email codes depend on you being able to open the inbox tied to your sign-in address. If that inbox is protected only by the same password habits, an authenticator app is the safer choice.

For another layer that limits where sign-in can happen, see Restrict portal access by IP.