Two-factor authentication
Two-factor authentication adds a second proof at sign-in: a rotating six-digit code (TOTP) from an authenticator app such as Google Authenticator, 1Password, or Authy. It is the only second factor on Superheat CN, shown as Two-factor authentication (双重认证) in the console. It is worth enabling on any account that can spend credits.
Enroll an authenticator app
- Go to Settings → Two-factor authentication and select Set up authenticator.
- Scan the QR code with your app. If the device cannot scan, use Copy secret to copy the secret shown under the code and enter it by hand.
- Type the six-digit code your app displays, then select Enable two-factor.
The card then shows an On badge and lists the authenticator with the date it was added. Add another enrolls a second app, and the trash icon removes one. An account can hold up to 10.
What sign-in looks like afterwards
After you enter your phone or email code, the console shows the Two-factor authentication screen asking for the code from your authenticator app. Enter the six digits to finish signing in. If you have more than one authenticator enrolled, a code from any of them is accepted — the console tries each enrolled factor. Use a different account on that screen signs you out instead.
Recovery
Superheat does not issue printed recovery codes. Recovery means having an authenticator you can still reach.
| Situation | What to do |
|---|---|
| Phone lost, a second authenticator enrolled | Enter a code from the other app |
| Still signed in somewhere | Remove the old authenticator in Settings, then set up a new one |
The console has no way to restore access once every enrolled authenticator is gone. Before you rely on a single phone, enroll a second authenticator app — on another device, or in a password manager that syncs.
What a stepped-up session means
Your session begins at the first factor, the six-digit code sent by SMS or email. When you have an authenticator enrolled, the console asks for it before it hands you the dashboard; answering it steps the session up.
The API enforces the same rule on its own. A session token of an account with an authenticator enrolled is refused with 403 MFA_REQUIRED until the session has stepped up, whichever app sent it, and the console answers that by sending you to the Two-factor authentication screen.
The step-up applies to the browser session you are in. Signing out, or signing in from another browser or device, means the second factor is requested again. Enrolling and removing authenticators happens in Settings, which needs a signed-in session.
API keys are a separate credential and are unaffected: they are rejected on account endpoints and on every admin action, so turning on two-factor does not change anything for scripts that use one.