Two-step verification: authenticator apps, passkeys, codes
Turn on two-step verification for your Voroa account with an authenticator app or a passkey, save recovery codes, and learn what to do if you lose a device.
Two-step verification asks for a second step every time you sign in: a 6-digit code from an authenticator app on your phone. Someone who learns your password, or gets into your email, still cannot sign in to Voroa without that code.
It applies to your account however you sign in - with a password, an email code, or GitHub. None of those replaces the second step.
Two-step verification is being rolled out. If you do not see it under Account settings, it is not available on your account yet.
Turn it on
- Open Account settings from the avatar in the top-right corner.
- Under Two-step verification, select Set up with an authenticator app. You are asked to confirm it is you first - with your password, or a code we email you.
- Scan the QR code with an authenticator app such as Google Authenticator, Microsoft Authenticator, 1Password or Authy. If you cannot scan it, type the key shown under the code into the app instead.
- Enter the 6-digit code the app shows, and select Confirm.
- Save your recovery codes (see below). Copy them or download them as a file, then tick I have saved these codes.
- Select Turn on two-step verification.
Turning it on signs you out on every other browser and device. Each of them asks for your second step the next time it signs in.
There is also an option to sign out tools at the same time. It turns off your SSH keys and AI-client tokens as well. Only tick it if you think someone else may have used your account - your scripts and CI would need new ones.
Passkeys and security keys
A passkey signs you in with your fingerprint, face or screen lock - on your laptop, or on your phone - and nothing to type. A security key is a small hardware key, such as a YubiKey, that you plug in or tap. Both work as your second step, and a passkey also signs you in on its own: select Sign in with a passkey on the sign-in screen. Neither can be used on a fake copy of the Voroa sign-in page - your browser only offers it on the real one.
To add one, open Account settings, give it a name under Passkeys and security keys, and select Add a passkey or Add a security key. Your browser walks you through the rest. You can rename or remove them at any time. If a passkey is your only second step, you cannot remove it while two-step verification is on.
Already have a passkey? Under Two-step verification, select Use my passkey as the second step instead of setting up an authenticator app.
Add more than one second step - for example your laptop’s passkey and your phone’s authenticator app - so that losing one device does not leave you relying on recovery codes.
Signing in
After your password, email code or GitHub, Voroa shows Two-step verification. Enter the current code from your authenticator app. A code works once; if it was just used, wait for the next one.
After several wrong codes in a row, Voroa makes you wait before trying another authenticator code. The wait starts at 30 seconds and grows. A recovery code always works, even while you are waiting.
Recovery codes
You get ten recovery codes when you turn two-step verification on. Each one works once, in place of a code from your app. Keep them somewhere safe and separate from your phone, such as a password manager.
Account settings shows how many you have left. When you are down to three or fewer, select Create new codes. Creating new codes replaces the old ones - the old codes stop working straight away.
If you lose your phone
Sign in with one of your recovery codes, or with a passkey or security key, then set up your authenticator app again on your new phone.
If you have none of those left, contact support from the email address on your account. For your safety, turning off two-step verification this way takes 72 hours:
- We email you when the request is made. While it is waiting, every page of your dashboard shows a notice with the date it can be completed. If you did not ask for it, select Cancel it in that notice.
- Signing in with any second step - your authenticator app, a passkey or a recovery code - cancels it too.
- After the 72 hours, sign in as usual. On the two-step verification screen, select Complete the reset approved by support. Two-step verification is turned off, every device is signed out, and your SSH keys and AI-client tokens stop working. Turn it on again from Account settings.
If you added an SSH key to your Voroa account after turning on two-step verification, support can reset it
straight away instead: we send you a one-time code, and you sign it with that key using ssh-keygen. Support
gives you the exact command.
An email inbox on its own never switches it off straight away. The 72-hour wait, and the fact that using any second step cancels the request, are the protection two-step verification exists to give you.
Confirm it’s you
Some changes ask you to confirm it is you, even while you are signed in. It lasts ten minutes. With two-step verification on, you confirm with a code from your app, your passkey or security key, or a recovery code; without it, with your password or a code we email you.
You are asked before:
- setting up, changing or turning off two-step verification, or creating new recovery codes
- changing your password, when two-step verification is on
- signing out another device, or all your other devices
- Sign out everywhere, including tools
- adding an SSH key, creating an AI-client token, or showing a database password
Turn it off
Under Two-step verification, select Turn off and confirm. Your authenticator app and recovery codes are removed from your account. You can turn it on again at any time.
You cannot remove your authenticator app while two-step verification is on and the app is your only second step - turn two-step verification off instead.