Skip to content
ROTTA PAYdocs
IntegrationManual
PTEN
Go to dashboard

Second factor (2FA)

The second factor protects your sign-in with a 6-digit code from an authenticator app (Google Authenticator, 1Password, Authy and others). It belongs to each person: each user turns on their own, on their own phone.

#Where it is

  • In your account (merchant or manager): Account → Settings, Security tab, Two-factor authentication box. The Profile item, in the menu under your name at the top of the screen, opens the same screen.
  • If you are on the brand team: click your name at the top of the screen, then Profile. The Your second factor screen has the same Two-factor authentication box.

The box shows Enabled and how many recovery codes are left, or tells you the second factor is not enabled.

#Turn it on

  1. Click Enable 2FA.
  2. In the Set up 2FA window, scan the QR with the authenticator app. Without a camera, use Add to authenticator / 1Password or copy the Manual code (base32) into the app.
  3. Type the code the app shows in 6-digit code and click Confirm and enable.
  4. The Save your recovery codes window shows your codes. Click Copy all, keep them in a safe place (a password manager, for example) and click I've saved my codes.

If the code is rejected, wait for the app to show the next code and try again. The code depends on the phone's clock: if it is always rejected, check that the phone's clock is set to automatic time.

#Recovery codes

  • They show up only once, right after you turn the second factor on.
  • Each code works one single time, in place of the app's code.
  • To use one at sign-in, click Use a recovery code and type the code exactly as it was shown, with the hyphen.
  • To get new codes, turn the second factor off and on again. The old codes stop working.
  • Without the app and without the codes, you are locked out of your account, as the window warns. Keep the codes somewhere other than your phone.

#At sign-in

With the second factor on, after email and password the Two-step verification screen asks for the Authentication code. Type the app's current code and click Continue. See Sign in, sign out and reset your password for the rejected-code messages.

#On withdrawals and transfers

In your account, the Withdrawal and transfer security box (Security tab) has the option Require 2FA for withdrawals and transfers. It applies to the whole account and to everything done in the dashboard.

  • When it is on, every withdrawal and every transfer in the dashboard asks for the code from the authenticator app (or a recovery code).
  • Anyone who has not turned on the second factor on their own user cannot withdraw or transfer until they do. The screen says the account requires 2FA.
  • Only the account's Owner or an Administrator turns this option on or off (see Team).
  • Turning it on is one click. To turn it off, someone with the second factor on confirms with the 2FA code in the Turn off 2FA for withdrawals and transfers? window and clicks Turn it off.

See also How to withdraw.

#Brand team

If you are on the brand team, the team can require the second factor from everyone. With that rule on, anyone who has not turned it on sees, at the next sign-in, the Turn on two-step verification screen:

  1. Scan the QR in the authenticator app, or type the key shown under "Or enter the key manually".
  2. Type the Authentication code and click Turn on and sign in.
  3. The Keep your recovery codes screen shows the codes. Keep them and click I saved the codes, sign in.

The dashboard opens only after this. With the rule on, anyone who turns the second factor off must turn it on again at the next sign-in.

#Turn it off

  1. In the Two-factor authentication box, click Disable 2FA.
  2. In the Disable 2FA? window, type your Current password.
  3. Click Disable 2FA.

Your account is protected by password alone again. If your account requires 2FA for withdrawals and transfers, you cannot withdraw or transfer until you turn it on again.

Questions this page doesn't answer? Write to suporte@rottapay.com.