Two-factor authentication
Protect your CompSniper dashboard with an authenticator app or a passkey (Touch ID, Face ID, Windows Hello), plus recovery codes.
Two-factor authentication (2FA) adds a second step when you sign in to the CompSniper dashboard. After your password, or after "Continue with Google", you confirm it is you with an authenticator app code or a passkey. It is optional and off until you turn it on.
Your API keys are not affected. 2FA protects the dashboard (API keys, billing, plan and settings). API
requests sent with Authorization: Bearer cs_... keep working exactly as before, so turning 2FA on never
breaks an integration.
Methods
You can use one or both:
| Method | How you confirm | Works with |
|---|---|---|
| Authenticator app | Type the 6-digit code the app shows | Google Authenticator, 1Password, Authy, Microsoft Authenticator, Bitwarden and any app that supports TOTP codes |
| Passkey | Touch ID, Face ID, fingerprint, Windows Hello, or a security key | Macs with Touch ID, iPhone and iPad, Android phones, Windows Hello, and FIDO2 security keys |
Passkeys saved in iCloud Keychain or Google Password Manager sync across your devices, so a passkey added on your Mac also works on your iPhone.
Turn it on
- Open Dashboard > Account and find Two-factor authentication.
- Authenticator app: select Set up, scan the QR code with your app (or type the key shown under it), then enter the 6-digit code to confirm.
- Passkey: select Add a passkey and follow your device's prompt (Touch ID, Face ID or Windows Hello).
- The first time you turn on a method, CompSniper shows 10 recovery codes. Save them in a password manager or another safe place. They are shown only once.
Signing in
After your password or Google sign-in, you see a second step:
- With an authenticator app, enter the current 6-digit code.
- With a passkey, select Use your passkey and confirm with Touch ID, Face ID or your device.
- Tick Trust this device for 30 days to skip the second step on that browser for 30 days.
Each authenticator code works once, and codes from a phone whose clock is slightly off (about 30 seconds) are still accepted.
Recovery codes
Each recovery code works once and can be typed instead of an authenticator code, for example if you lose your phone. The Account page shows how many unused codes you have. Select Get new codes to replace all of them; the old ones stop working immediately.
Turn it off or remove a passkey
On the Account page, select Turn off next to the authenticator app, or Remove next to a passkey, then confirm with a current authenticator code or a recovery code. When no method is left, 2FA is off and sign-in goes back to your password or Google alone.
Lost access to every method
If you lost your phone, your passkeys and your recovery codes, contact support from the email on your account. After we confirm it is you, we reset 2FA so you can sign in with your password and set it up again.
Security details
- Authenticator secrets are stored encrypted, and recovery codes are stored only as hashes.
- Passkeys use the WebAuthn standard: your fingerprint or face never leaves your device, and CompSniper stores only a public key.
- Failed codes are rate limited.
- The second step expires after 10 minutes. If it does, sign in again.