Account Security (2FA)

DirectCryptoPay supports Two-Factor Authentication (2FA) using TOTP (Time-based One-Time Passwords). When enabled, you'll need to enter a 6-digit code from your authenticator app every time you sign in -- in addition to your regular login method.

Why Enable 2FA?#

Your DirectCryptoPay account controls where customer payments are sent. If someone gains access to your account, they could change your payout wallet address. 2FA adds a second layer of protection that works even if your email or wallet is compromised.

Compatible Authenticator Apps#

Any TOTP-compatible app works with DirectCryptoPay:

• Google Authenticator (Android / iOS)
• Authy (Android / iOS / Desktop)
• 1Password (all platforms)
• Microsoft Authenticator (Android / iOS)
• Bitwarden (all platforms)

Setting Up 2FA#

1. Log in to your Dashboard
2. Navigate to Settings > Security
3. Click Enable 2FA
4. Scan the QR code with your authenticator app (or enter the manual key)
5. Enter the 6-digit verification code from the app
6. Save your recovery codes in a secure location

Signing In with 2FA#

Once 2FA is enabled, the login flow adds one step:

1. Sign in as usual (Email, Google, or Wallet)
2. You are redirected to the 2FA verification screen
3. Enter the 6-digit code from your authenticator app
4. You are granted access to the dashboard

This applies to all four authentication methods: Magic Link, OTP email, Google OAuth, and Sign-In With Ethereum (SIWE).

Recovery Codes#

When you enable 2FA, you receive 8 one-time recovery codes in XXXX-XXXX format. These are your backup if you lose access to your authenticator app.

• Each recovery code can only be used once
• You can download or copy the codes from the setup screen
• Store them in a secure location (password manager, printed copy, etc.)

Using a Recovery Code#

1. On the 2FA verification screen, click "Use a recovery code"
2. Enter one of your saved recovery codes
3. You are granted access to the dashboard

Disabling 2FA#

1. Go to Settings > Security
2. Click Disable 2FA
3. Enter a 6-digit code from your authenticator app to confirm
4. 2FA is removed from your account

Technical Details#

For developers and security-conscious users: