Skip to main content
Your Minisend account can move money, so it’s worth a second lock on the door. Dashboard → Settings → Security is where you set one up.

​
Two-factor authentication

Signing in with email alone means anyone who can read your inbox can reach your dashboard. Two-factor adds a six-digit code from an app on your phone, so an email address on its own is no longer enough.
Two-factor is required for owners and admins from 15 September 2026. Members, who have read-only access, can turn it on but aren’t asked to. If you haven’t set it up yet, the dashboard will walk you through it the next time you sign in.

​
Set it up

1

Scan the code

Open Settings → Security and scan the QR code with your authenticator app. Google Authenticator, 1Password, Authy, and anything else that takes a QR all work. If you can’t scan, there’s a key underneath you can type in instead.
2

Confirm a code

Enter the six-digit code your app shows. Nothing is switched on until this step succeeds, so an abandoned setup never locks you out.
3

Save your recovery codes

You’ll get ten single-use recovery codes. Download or copy them and keep them somewhere separate from your phone.
Recovery codes are the way back in if you lose your phone. They’re shown once, and each one works only once. Save them before you close the screen.

​
Signing in afterwards

After your email sign-in, you’ll be asked for a code. Passing it lasts 12 hours before you’re asked again, so a normal working day only needs it once. If your phone isn’t to hand, use one of your recovery codes instead. The dashboard tells you how many you have left.

​
Managing it

From Settings → Security you can:
  • Generate new recovery codes if you’re running low or think the old ones were seen. The previous set stops working straight away.
  • Turn two-factor off, which asks for a current code first. Owners and admins will be prompted to set it up again, since it’s required for those roles.
Setting up two-factor on a shared laptop? Use an authenticator app on your own phone rather than the same machine. The point of the second factor is that it lives somewhere else.

​
Losing access

If you’ve lost both your phone and your recovery codes, message us from the email address on the account and we’ll help you get back in. For an account with more than one person on it, an owner or admin can also help from the Team page.

​
Keeping the rest of your account safe

  • Keep API keys in backend environment variables, never in frontend code or a public repo. See API keys.
  • Give teammates the lowest role that lets them do their job. Member is read-only. See Team.
  • Verify the signature on every webhook before acting on it. See verification.