How do I set up an authenticator and use recovery codes?

Sign in to your account, expand My account → Security and open Protection. Under Authenticator app, complete Sign in again if requested, then choose Set up authenticator when the status is Off. Scan the QR code or enter the Setup key in a time-based authenticator app, then enter its six-digit code and choose Confirm authenticator. Save the ten recovery codes before signing in again. If you lose the authenticator, choose Use a recovery code on Verify your sign-in and enter one unused code.

Open your personal security settings

Sign in to your account. In the sidebar, expand My account, choose Security and select Protection. On a phone, open the navigation menu first. These settings protect your personal sign-in across your client accounts.
Find Authenticator app. If the page asks you to Sign in again, choose that button and complete your usual sign-in. Return to Protection → Authenticator app to continue. Only the account holder can change their authenticator settings. If the status is already On, you do not need to start a new setup. Use your existing authenticator and keep its recovery codes.
These steps add an authenticator code to password sign-in. A passkey has its own device prompt; see our passkey guide for that setup.

Connect and confirm your authenticator

When Authenticator app is Off, choose Set up authenticator. Under Connect your authenticator, scan the QR code with your authenticator app or enter the Setup key manually. Choose a time-based code if the app asks.
Keep the QR code and setup key private. They can let someone generate your sign-in codes. Do not paste them into a ticket, send them to anyone or include them in a screenshot you share.
Enter the current code in Six-digit code from your new authenticator and choose Confirm authenticator. Adding the entry to your app alone does not complete setup. Use Cancel setup to stop before confirmation.
If the step expires, sign in again and restart it. If confirmation was interrupted and you cannot tell whether it succeeded, sign in again to check your settings before starting another setup.

Save the recovery codes before leaving

After confirmation, Save your recovery codes shows ten codes. Each works once, and this set will not be shown again. Store them privately, separately from your authenticator, so losing one device does not also lose your recovery method.
Choose Copy codes and save them in a secure place. If copying fails, select and copy the displayed codes manually. Confirm I have saved my recovery codes, then choose Sign in again. The codes leave the screen when its timer ends, so save them before leaving.
Completing setup signs out your customer sessions. If you sign in with your password, wait for a new authenticator code and use that code when prompted. Do not reuse the code that confirmed setup.
If you missed the recovery codes, sign in again with your authenticator and open My account → Security → Protection. Choose Replace recovery codes, verify with a current authenticator code and save the new set. The replacement invalidates the previous recovery codes.

Use recovery after losing your authenticator

On our sign-in page, sign in with your password. On Verify your sign-in, choose Use a recovery code, enter one unused Recovery code and choose Verify and sign in. Keep track of the used code because it cannot be used again.
Open My account → Security → Protection → Authenticator app. For an authenticator set up here without the Keep your other recovery codes notice, choose Replace authenticator. Under Verify using, choose Recovery code, enter another unused code and choose Continue. Connect and confirm the new authenticator, then save the new recovery codes. Your existing authenticator stays active until the replacement is confirmed.
If you have lost both your authenticator and recovery codes, use a Google sign-in or passkey already linked to your account to regain access, or contact us if no existing method works. Signing in another way does not remove the verification needed to change the authenticator. Do not send us a password, setup key or recovery code.
If the page says Keep your other recovery codes, keep both sets separate and contact us for help with a lost authenticator. This account has another two-step setup, and the page does not offer Replace authenticator. Recovery codes from this page apply to the authenticator set up here. Do not turn off protection to work around a missing replacement option.