跳到主要内容

Two-factor authentication is now available on every iApp account

· 3 分钟阅读
Kobkrit Viriyayudhakorn
Kobkrit Viriyayudhakorn
CEO @ iApp Technology

Your iApp account holds API keys and a credit balance. If someone gets your password, they get both. From today, every account can add a second lock: two-factor authentication (2FA) with any standard authenticator app.

It is opt-in — nothing changes until you turn it on — and it takes about a minute to set up.

Turning it on​

Go to Account Security (also in the account menu, top right) and choose Turn on two-factor authentication. Then:

  1. Scan the QR code with an authenticator app — Google Authenticator, Microsoft Authenticator, Authy, 1Password, or any other TOTP app. Can't scan? Reveal the setup key and type it in.
  2. Enter the 6-digit code the app shows, to prove it is working.
  3. Save your recovery codes. You get ten. Each works once.

From then on, signing in asks for your password and then a code from your phone. Someone who steals your password still cannot get into your account.

Recovery codes matter more than you think​

The most common way people lock themselves out of a 2FA account is a lost, wiped, or replaced phone. The ten recovery codes we show you at the end of setup are the way back in — each one signs you in once, in place of the app.

They are shown exactly once. Download them, or put them in your password manager — anywhere that is not the phone running the authenticator app. If you run low, generate a fresh set from the same page; the old set stops working immediately.

Works with Google, Facebook and GitHub sign-in too​

If you sign in with a social account rather than a password, 2FA still applies: after the provider hands you back, we ask for your authenticator code before issuing a session. Turning it off for those accounts needs just the code, since there is no password to confirm.

See who has been signing in​

The security page now also shows recent sign-in activity — the last 20 attempts on your account, successful or not, each with the method used, the device, the IP address, and the time. Failed attempts are listed too, so a burst of wrong-password entries from an IP you don't recognise is visible rather than silent.

If something there looks wrong, there is a Sign out of all devices button on the same page. It immediately invalidates every session on every device — including the one you are using — so you sign in again afterwards. Combined with a password change, it is the fastest way to shut out someone who has your credentials.

A note for API integrations​

2FA protects the portal login, not your API calls. Your API keys keep working exactly as before — no code changes, no rotation, no second factor on API requests. Automated integrations are unaffected.

That is deliberate: the second factor guards the account where keys are issued and credits are purchased. If you want to reduce API-key risk as well, rotate keys periodically from the API keys page and keep separate keys per application, so one leak doesn't mean revoking everything.

Our recommendation​

Turn it on — particularly if your account has a credit balance or production API keys. It costs a minute now and removes an entire class of account takeover.