How do I turn on two-factor authentication?
Short answerOpen Account in your dashboard, press "Set up 2FA" under Two-Factor Authentication, scan the QR code with an authenticator app and type the code it shows. Save the eight recovery codes you get, because they are shown only once.
Set up 2FA
Log in and open Account in the menu of your dashboard.
Scroll to Two-Factor Authentication and press "Set up 2FA".
Scan the QR code with an authenticator app such as Google Authenticator, Authy or 1Password. If you cannot scan it, type the code under it into the app by hand.
Type the six digit code your app shows into "Code from your app" and press "Confirm and turn on".
Save the eight recovery codes somewhere safe, away from your phone, and press "I saved these, done". Each code lets you in once if you lose the app.
Messages you can get while setting up or using 2FA
| What it says | What it means and what to do |
|---|---|
That code is not right. | Shown in the setup step when the six digits do not match. The code changes every few seconds, so type the one that is on screen now. If every code fails, the clock on your phone is probably off: switch on automatic time in the phone settings. |
That code is not right. Try the next one your app shows. | Shown at login. Wait for the app to show a fresh code and type that one. Make sure you read the entry for Astroworld Hosting and not another account in the same app. |
Lost your phone? A backup code works here too. | The same field accepts one of the eight recovery codes you saved when you turned 2FA on. Each code works once and is used up after that. |
What changes after you turn it on
Every login asks for your password and then for a current code from the app. The code is also asked when you delete your account.
Turning 2FA off needs the same proof as turning it on: your password and a current code. That way somebody who gets into an open session cannot switch it off quietly.
Lost your phone
Use one of your recovery codes at the login step instead of the app code. Each one works once. Once you are in, turn 2FA off and set it up again on your new phone, which gives you a fresh set of codes.
Why a code from an app and not a text message
An authenticator app makes the code on your own phone, from a secret that was shared once through the QR code. Nothing is sent over the phone network, so a stolen phone number or a message that is intercepted does not get anyone into your account. The app also works without signal, which a text message does not.
Where the second step is asked
At every login with your email address and password, after the password. Also after the Google button: signing in with Google proves who you are to Google, and your own code proves it to us. And once more when you delete your account, so an open laptop is not enough to wipe your servers.
Your panel staff are not affected by your 2FA. They log in with their own accounts, and each of them can turn on 2FA for themselves on their own Account page. For anybody with rights to files, worlds or backups on your server, ask them to do so.
Moving to a new phone
Most authenticator apps can transfer their accounts to a new phone; do that before you reset the old one. If you already lost it, log in with a recovery code, turn 2FA off on the Account page and set it up again from the new phone. You then get eight new recovery codes and the old ones stop working.
Questions people also ask
Which authenticator apps work?
Any app that reads a standard QR code for time based codes: Google Authenticator, Authy, 1Password, Microsoft Authenticator, Bitwarden and the like.
Does 2FA also protect my server panel?
Yes. The panel uses the same login, so nobody reaches your server without the second step either. People you invited as staff have their own login and can turn on 2FA for themselves.
Can I see my recovery codes again later?
No. They are shown only once, when you turn 2FA on. If you lost them while you still have the app, turn 2FA off and on again to get a fresh set.
I lost both my phone and my recovery codes. What now?
Write to us from the email address on the account, with the name of your server. We verify that the account is yours before we remove the second step, which takes longer than a recovery code, so keep those codes somewhere you can find them.
Does 2FA slow down my players?
No. Two-factor authentication protects the account and the panel. Your players join the Minecraft server with their own game accounts and never see it.