Skip to main content

Account Security & Two-Factor Authentication

Two-factor authentication (2FA) adds a dynamic verification code on top of your password. Even if your password leaks, attackers still cannot sign in. Glow Prow 2FA works with popular authenticator apps such as Google Authenticator, Microsoft Authenticator, 1Password, and Authy.

Entry Point​

After signing in, go to Account → Security → Two-Factor Authentication (/account/security/twofa). The same security center also manages third-party platform bindings and active sessions.

Enabling 2FA​

  1. Open the page and make sure the status is "not enabled";
  2. Click Enable and confirm with your current account password;
  3. Scan the QR code with your authenticator app. If scanning is not possible, copy the manual key and enter it manually;
  4. Save the recovery codes shown on the page;
  5. Enter the 6-digit code currently shown in your authenticator app in step 3, then click Confirm enable.

Note: The temporary setup token is valid for 10 minutes. If it expires, click Enable again to restart the flow.

Verifying at Sign-in​

  • After entering your username and password, accounts with 2FA enabled must provide a 6-digit dynamic code;
  • Codes rotate every 30 seconds. Verification accepts a one-window tolerance before and after, so make sure the authenticator device has automatic time sync enabled;
  • Trust this computer on the sign-in form: when checked, this browser can sign in without a code for 7 days. Do not check it on public computers;
  • After a successful verification, the same account can skip repeated verification for 3 hours.

Recovery Codes​

  • Enabling 2FA generates 10 one-time 8-character recovery codes, each usable only once;
  • A used recovery code is marked as consumed and the remaining codes stay valid;
  • Recovery codes are shown only once at generation time. The server stores hashes only, so they cannot be viewed again after leaving the page.

Regenerating and Disabling​

  • Regenerate recovery codes: requires your current password and a second confirmation. Regeneration immediately invalidates all old recovery codes and the old key;
  • Disable 2FA: requires your current password and a second confirmation. After disabling, sign-in no longer asks for a dynamic code.

FAQ​

The code is always rejected. Make sure automatic time sync is enabled on the authenticator device, then retry with the latest code.

The setup flow says the token has expired. Setup tokens last 10 minutes. Click Enable again to restart. An already-enabled 2FA state is not affected.

Why is "Trust this computer" missing on the 2FA settings page? Trusting a device is only offered on the sign-in form to reduce verification prompts. The security settings page does not provide that option.