Turn on two-step sign-in
Two-step sign-in adds a second check when you sign in to your DomainPilot account. After your password, you enter a 6-digit code from an authenticator app on your phone. Someone who learns your password still cannot get in without your phone. This guide is for every account holder and takes a few minutes.
How authenticator codes work
An authenticator app is a phone app that creates short, time-based codes. When you set it up, the app and your account share a secret key, usually by scanning a QR code. From then on, both sides calculate the same 6-digit code from that key and the current time, and the code changes about every 30 seconds. Because the code depends on the time, your phone's clock must be correct: set it to update automatically.
Turn it on
- Sign in to your DomainPilot account (choose Sign in at the top of the DomainPilot website).
- Open Menu at the top left and choose Login & security under My account.
- Find the Two-step sign-in section. Its badge shows Off. Choose Set up two-step sign-in.
- If a Confirm it's you page opens, enter your Password and choose Continue.
- Under 1. Scan this code, open your authenticator app, add a new account and scan the QR code on the screen.
- If you cannot scan it, enter the key shown under Can't scan it? Enter this key in the app: into the app instead. When you are setting up on the same phone you use for the app, you can choose Open in the authenticator app on this phone.
- Under 2. Enter the code from the app, type the current code from the app into 6-digit code.
- Choose Turn on two-step sign-in.
You return to Login & security with the message "Two-step sign-in is on. From now on you will enter a code from your app when you sign in." The badge now shows On.
Nothing changes until the code is accepted, so you can leave at any time with Cancel at the bottom of the setup page.
If the code is not accepted
- "That code is not valid." Check that the time on your phone is set automatically, then enter the newest code shown in the app.
- "The setup expired." Scan the new QR code shown on the page, then enter a fresh code.
If the section says "coming soon"
If the Two-step sign-in section says that two-step sign-in with an authenticator app is coming soon, it is not yet available for your account and there is no setup button. Check back later.
Sign in with two-step sign-in
After you enter your email address and password, the Enter your code page asks for the code from your app. Type it into Code and choose Log in. See Sign in and reset your password.
While two-step sign-in is on, some sensitive changes in your account, such as changing nameservers or asking for a transfer code, open the Confirm it's you page. Enter your Password and the Code from your app, then choose Continue.
Move it to a new phone
The setup screen recommends an app that backs up its codes to your account with the app maker, because that makes changing phones easier. If your app does not do that:
- Keep your old phone until the move is finished.
- On Login & security, enter a code from the old phone in Code from your app, to turn it off and choose Turn off.
- Choose Set up two-step sign-in and follow the steps above with the new phone.
Turn it off
- Open Login & security.
- In the Two-step sign-in section, enter the current code from your app in Code from your app, to turn it off.
- Choose Turn off. If a Confirm it's you page opens first, enter your password and a code, choose Continue, then repeat the step.
The page confirms "Two-step sign-in is off. We recommend turning it on again soon."
If you lose your phone
DomainPilot does not issue backup or recovery codes for two-step sign-in. If you lose access to your authenticator app, the DomainPilot team has to turn two-step sign-in off for you once it has checked that the account is yours, which can take some time.
- If you are still signed in somewhere, open Login & security, then If you lose your phone, and choose Contact our team.
- If you cannot sign in, use the DomainPilot contact form. The Enter your code page links to it under Can't use your authenticator app?
- Write from the email address on your account, so the team can match your request to it.
The team never asks for your password or a code. Anyone who does is not from DomainPilot.
Too many wrong codes pause code checks for your account for a while, and the account owner receives an email about it. If you get that email and did not try to sign in, change your password straight away.