Why we ask for your authenticator code again
Short answer
Some actions need a code from your authenticator app from the last ten minutes, even while you are signed in, because they are what someone using a stolen session would try first.In this article
Which actions
You may be asked for a fresh code before you:
- make or roll a live API key;
- invite someone, change a role or remove someone;
- change your payout schedule, or send new bank details for your payouts;
- change your security settings;
- write risk rules;
- transfer ownership of the business, or close it.
Turning two-step verification off needs a code from the last five minutes.
What to do
Enter the code from your authenticator app, and you go back to what you were doing. Press the button again if it did not go through.
Refunds do not ask for a code.
Why
Your password or passkey shows who you are when you sign in. A fresh code shows it is still you, now. Someone with a laptop you left signed in cannot change where your payouts go, or let themselves into your team, without your phone.
If you have not set up two-step verification, you are asked to before you can do these.