---
id: help.security.step-up
title: "Why we ask for your authenticator code again"
canonical: https://docs.secureprocessing.app/help/security/why-we-ask-for-your-code-again
description: "Some actions need a code from your authenticator app from the last ten minutes, even while you are signed in, because they are what someone using a stolen session would try first."
last_verified: 2026-11-02
---

# Why we ask for your authenticator code again

Some actions need a code from your authenticator app from the last ten minutes, even while you are signed in, because they are what someone using a stolen session would try first.

Who can: Owner, Administrator can change security settings in [Settings → Security](https://dashboard.secureprocessing.app/settings/security).

## Which actions

You may be asked for a fresh code before you:

- make or roll a live API key;
- invite someone, change a role or remove someone;
- change your payout schedule, or send new bank details for your payouts;
- change your security settings;
- write risk rules;
- transfer ownership of the business, or close it.

Turning two-step verification off needs a code from the last five minutes.

## What to do

Enter the code from your authenticator app, and you go back to what you were doing. Press the button again if it did not go through.

Refunds do not ask for a code.

## Why

Your password or passkey shows who you are when you sign in. A fresh code shows it is still you, now. Someone with a laptop you left signed in cannot change where your payouts go, or let themselves into your team, without your phone.

If you have not set up two-step verification, you are asked to before you can do these.

For developers: [Team roles and permissions](https://docs.secureprocessing.app/team-roles.md)

## Related

- [Turn on two-step verification](https://docs.secureprocessing.app/help/security/turn-on-two-step-verification.md)
- [Team roles: who can do what](https://docs.secureprocessing.app/help/account/team-roles.md)
- [Lost your phone? Get back into your account](https://docs.secureprocessing.app/help/security/lost-your-phone.md)

Still stuck? Write to [admin@secureprocessing.app](mailto:admin@secureprocessing.app) with what you were doing when we asked.