Two-factor authentication
How to enable TOTP-based 2FA, generate recovery codes, and keep your account secure.
Two-factor authentication (2FA) adds a second verification step to your login: your password plus a time-based one-time code from an authenticator app. This means that even if your password is compromised, an attacker still can't access your account without physical access to your device.
GreenLightOS uses TOTP (Time-based One-Time Password) — the same standard used by Google, GitHub, and most major platforms. Any authenticator app that supports TOTP will work.
Compatible authenticator apps
| App | Platform | Notes |
|---|---|---|
| Google Authenticator | iOS, Android | Simple and widely used |
| Authy | iOS, Android, Desktop | Supports multi-device sync and encrypted backup |
| 1Password | iOS, Android, Desktop | Integrates 2FA into your password manager |
| Microsoft Authenticator | iOS, Android | Supports both TOTP and Microsoft accounts |
| Any TOTP-compatible app | Various | Any app that supports RFC 6238 TOTP will work |
Enabling two-factor authentication
Go to Security settings
From the sidebar, navigate to Settings → Security. Click Enable Two-Factor Authentication.
Scan the QR code
Open your authenticator app and scan the QR code displayed on screen. This adds GreenLightOS to your app as a new account entry. If you can't scan the QR code, you can manually enter the setup key shown below it.
Enter your first code
Type the 6-digit code shown in your authenticator app to verify that setup worked correctly. Codes refresh every 30 seconds — use the currently displayed code.
Save your recovery codes
After verification, you'll receive a set of single-use recovery codes. Download or copy them and store them somewhere safe — a password manager, a printed copy in a secure location. These are the only way to access your account if you lose your authenticator device.
Recovery codes are one-time use
Each recovery code can only be used once. After using a recovery code to log in, go to Security settings and generate a new set immediately. Treat recovery codes with the same security as your password.
What do I do if I lose access to my authenticator app?
Use one of your recovery codes to log in. Once logged in, go to Settings → Security → Two-Factor Authentication → Disable, then re-enable with your new device.
Can I disable 2FA after enabling it?
Yes. Go to Settings → Security → Two-Factor Authentication → Disable. You'll be asked to confirm your password. Disabling 2FA returns your account to password-only login.
Is 2FA required?
2FA is optional during early access. We strongly recommend enabling it, particularly if your account holds VitaeMe data, WritersRoom projects, or GreenLight campaign results.