FeatureAll modes
Two-factor authentication for your website account
You can now protect your website account with two-factor authentication. Once it is on, nobody can sign in without a code from your authenticator app, even with access to your Microsoft account or in-game login code.
Key changes
- Two-factor authentication is now available for every website account
- Once it is on, signing in needs a 6-digit code from your authenticator app
- Turn it on from Account, Settings, Security
Setting it up
- Open Account, Settings, Security and choose to turn on two-factor authentication
- Scan the QR code, or type the key, in any authenticator app such as Google Authenticator, Authy, 1Password, Microsoft Authenticator or Aegis
- Enter the 6-digit code from the app to confirm
- You get ten one-time recovery codes. They are shown only once, so save them somewhere safe
- Turning it on signs you out of the website everywhere else
Signing in
- After you sign in with Microsoft or with the in-game
/web logincode, the website asks for your 6-digit code or a recovery code - Without that code nobody gets in, even with access to your Microsoft account or your in-game code
- Five wrong codes lock code entry for 15 minutes
Managing it
- Turning it off or getting new recovery codes needs a current code and a sign-in from the last 15 minutes
- Players who have not turned it on see a reminder on the website, which can be snoozed
Lost your authenticator
If you lose both your authenticator and your recovery codes, open a support ticket. Staff will verify your identity and reset two-factor authentication, which signs you out everywhere.
Who should turn it on
Everyone. It matters most if you have a rank, gems or past store purchases on your account, and every staff member should have it on.