Two-factor authentication (2FA) adds a second step to logging in, so a stolen password alone is not enough to get into your account. You will find it under Security in your dashboard sidebar.
Choosing a method
You can protect your account with one of two methods:
- Authenticator App — use Google Authenticator, Authy, or a similar app to generate a 6-digit code that changes every 30 seconds.
- Email Verification — HotiLINK emails you a 6-digit code at login time.
Only one method can be active at a time. To switch methods later, disable your current method first, then set up the new one.
Setting up an Authenticator App
- Go to Security and click Set Up Authenticator.
- Scan the QR code with your authenticator app (or enter the setup key manually).
- Enter the 6-digit code the app generates to confirm setup.
Setting up Email Verification
Click Enable Email Verification on the Security page. No further setup is needed — a code will be emailed to you the next time you log in.
Backup codes
As soon as you enable 2FA, you are given 8 one-time backup codes. Each code works once and lets you sign in if you lose access to your authenticator app or email.
Save them somewhere safe right away — they are only shown once, immediately after you enable 2FA. Use the Download as text file button on the Security page to keep a copy.
Running low? You can regenerate a fresh set of 8 codes at any time from the Security page — this immediately invalidates all of your old codes.
Logging in with 2FA
After entering your password, you will be asked for your 6-digit code, from your authenticator app or your email depending on which method you enabled. If you do not have access to that, enter one of your backup codes instead.
Disabling two-factor authentication
On the Security page, use Disable Two-Factor Authentication. You will need to confirm with your current password plus a valid code (from your authenticator app, email, or a backup code). Once disabled, your account is protected by your password alone.
Lost access to everything?
If you have lost your authenticator app, your email access, and all of your backup codes, contact support — we will need to verify your identity before removing 2FA from your account.