Objective
Two-factor authentication (2FA) requires you, the user, to provide two means of identification in order to access your account. For Twilio accounts, this would include your standard login credentials (email address and password), as well as a randomized verification code sent to your phone (via a call, SMS message, or an authentication app like Authy). This guide explains how to setup and manage 2FA on your Twilio account.
Notice: 2FA is a required security feature on all Twilio accounts, and can't be disabled. If you are experiencing issues logging in due to 2FA, see Unable to sign-in to a Twilio project 2FA enabled.
Procedure
Enable 2FA for your login
- Access the User Settings page in Console.
- Verification code sent to your email address is required to access the user setting page. Once you receive the code, please enter the code and click “Verify”.
- Click on the "Set up 2FA" button.
- Users enabling 2FA for the first time will be required to go through a one-time verification process with the number they want to use on their account for 2FA.
- An emergency recovery recovery code will be displayed; please make a note of it or store the downloaded file in a secured storage. When you’re ready to complete this process, click Finish and continue to the dashboard.
- Your number will appear in the Two-factor authentication (2FA) part of the User Settings and on clicking Edit you will be able to change your 2FA authentication method.
What is a Recovery Code and how to generate a new one
Once you've completed this process, you will receive a recovery code. This code is EXTREMELY important; be sure to write it down, and store it in a very safe place. In the case that you lose your phone, the recovery code will allow you to login to your account instead of using the six-digit verification code that is sent to your phone.
If you lost access to your recovery code, you can generate a new one by following the steps:
- Access the User Settings page in Console.
- Click on the Generate new code link.
- Confirm the prompt notifying you that your old recovery code will become invalid.
- You will see your new recovery code with an option to download it as a file that should be stored in a secured data repository.
Notice: You are the only one that has access to this recovery code. This code will only be displayed the moment after you’ve verified your phone number. It is not retrievable after you’ve navigated away from this page. We suggest storing your recovery code with a safe and secure password manager software, like 1Password or Keypass. Don’t just write it down.