> ## Documentation Index
> Fetch the complete documentation index at: https://docs.minisend.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Turn on two-factor authentication with an authenticator app, save your recovery codes, and keep access to your account.

Your Minisend account can move money, so it's worth a second lock on the door. **Dashboard → Settings → Security** is where you set one up.

## Two-factor authentication

Signing in with email alone means anyone who can read your inbox can reach your dashboard. Two-factor adds a six-digit code from an app on your phone, so an email address on its own is no longer enough.

<Note>
  Two-factor is **required for owners and admins** from **15 September 2026**. Members, who have read-only access, can turn it on but aren't asked to. If you haven't set it up yet, the dashboard will walk you through it the next time you sign in.
</Note>

### Set it up

<Steps>
  <Step title="Scan the code">
    Open **Settings → Security** and scan the QR code with your authenticator app. Google Authenticator, 1Password, Authy, and anything else that takes a QR all work. If you can't scan, there's a key underneath you can type in instead.
  </Step>

  <Step title="Confirm a code">
    Enter the six-digit code your app shows. Nothing is switched on until this step succeeds, so an abandoned setup never locks you out.
  </Step>

  <Step title="Save your recovery codes">
    You'll get ten single-use recovery codes. Download or copy them and keep them somewhere separate from your phone.

    <Warning>
      Recovery codes are the way back in if you lose your phone. They're shown once, and each one works only once. Save them before you close the screen.
    </Warning>
  </Step>
</Steps>

### Signing in afterwards

After your email sign-in, you'll be asked for a code. Passing it lasts **12 hours** before you're asked again, so a normal working day only needs it once.

If your phone isn't to hand, use one of your recovery codes instead. The dashboard tells you how many you have left.

### Managing it

From **Settings → Security** you can:

* **Generate new recovery codes** if you're running low or think the old ones were seen. The previous set stops working straight away.
* **Turn two-factor off**, which asks for a current code first. Owners and admins will be prompted to set it up again, since it's required for those roles.

<Tip>
  Setting up two-factor on a shared laptop? Use an authenticator app on your own phone rather than the same machine. The point of the second factor is that it lives somewhere else.
</Tip>

## Losing access

If you've lost both your phone and your recovery codes, [message us](https://t.me/minisendapp) from the email address on the account and we'll help you get back in. For an account with more than one person on it, an owner or admin can also help from the [Team](/dashboard/team) page.

## Keeping the rest of your account safe

* Keep API keys in backend environment variables, never in frontend code or a public repo. See [API keys](/dashboard/api-keys).
* Give teammates the lowest role that lets them do their job. **Member** is read-only. See [Team](/dashboard/team).
* Verify the signature on every webhook before acting on it. See [verification](/webhooks/verification).