Turn on two-factor authentication (web)
Web
Two-factor authentication (2FA) adds a one-time code from an authenticator app on top of your sign-in. It's set up on the web.
Steps
- Sign in at svgoat.app and go to Account → Security → Two-Factor Authentication.
- Start setup and scan the QR code with an authenticator app (such as Google Authenticator or Authy).
- Enter the 6-digit code from the app and tap Verify & Enable.
- Save your backup codes somewhere safe — they let you get in if you lose your phone.
Manage it
- Regenerate creates fresh backup codes.
- Disable turns 2FA off.
Note: 2FA is a web-only setting today. There's no separate 2FA step to configure in the mobile apps.
Note: Keep your backup codes somewhere other than the phone with your authenticator app, so a lost phone doesn't lock you out.