---
title: "Two-step authentication"
sidebar_label: "Two-step authentication"
sidebar_position: 9
description: "How to enable two-step authentication via an app, email, or SMS, how to create or update backup codes, and more"
---

import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'
import Formbricks from '@theme/MDXComponents/Formbricks'

# Two-step authentication

:::info

Two-step authentication is not available for [federated users](/access-control/federations/about-federations.mdx).

:::

With two-step authentication, you must enter both your password and a one-time verification code to log in to your account. Two-step authentication is enabled by default for all users after they register and complete their profile.

[Disable two-step authentication](#disable-two-step-authentication-if-there-is-access-to-control-panel) in the control panel and re-enable it can only be done by the [Account Owner](/access-control/user-types.mdx#account-owner). For users with [other roles](/access-control/access-management.mdx), two-step authentication is always enabled; the user can only choose the method for receiving the code.

You can obtain a one-time code by:

* in an [authenticator application](#login-via-authenticator-app), for example, Google Authenticator or Microsoft Authenticator. You can receive a code even if the device has no internet or cellular connection;
* by [email](#login-via-mail) — the code is sent to the email address you specified in your profile. You can [change the email address used to receive codes](#change-phone-number-or-email-for-2fa).

Additionally, you can [create backup codes](#create-backup-codes) that can replace the verification code from an email or authenticator app if you lose access to your email or the device with the authenticator app. If you have lost your backup codes or have used all of them, you can [update them](#update-backup-codes) in the control panel.

If none of the methods for obtaining a confirmation code are available to you, [disable two-step authentication](#disable-two-step-authentication-if-there-is-access-to-control-panel).

## Enable login via authenticator application \{#login-via-authenticator-app}

You can use any authenticator application, such as Google Authenticator or Microsoft Authenticator.

1. In the [control panel](https://my.selectel.ru/profile/security), open the menu in the upper right corner (account number) and select **Profile**.
2. Go to the **Security and Login** section.
3. In the **Account login method** block, in the **Two-step authentication** row, click **Edit**.
4. Turn on the **Authenticator application** toggle switch.
5. Enter your user account password. If you enter the password incorrectly three times, the session will be terminated and two-step authentication setup will be locked for 24 hours.
6. Click **Confirm**.
7. Scan the QR code in any authenticator application. If you cannot scan the code, enter the secret key in the application.
8. Enter the six-digit code generated in the application.
9. Click **Connect**.

## Enable login via email \{#login-via-mail}

The confirmation code is sent to the email address you specified in your profile.

You can [change the email address for two-step authentication](#change-phone-number-or-email-for-2fa).

1. In the [control panel](https://my.selectel.ru/profile/security), open the menu in the upper right corner (account number) and select **Profile**.
2. Go to the **Security and Login** section.
3. In the **Account login method** block, in the **Two-step authentication** row, click **Edit**.
4. Turn on the **Email** toggle switch.
5. Enter your user account password. If you enter the password incorrectly three times, the session will be terminated and two-step authentication setup will be locked for 24 hours.
6. Click **Confirm**.
7. Enter the four-digit confirmation code you received in the email. The code is valid for five minutes. If you do not have time to enter the code, request it again.
8. Click **Connect**.

## Create backup codes \{#create-backup-codes}

We recommend creating backup codes when you first log in to your account. Each code can be used only once. You can view the number of unused backup codes in the [control panel](https://my.selectel.ru/profile/tsa) in the **Two-Step Authentication** → block **Backup Codes**.

1. In the [control panel](https://my.selectel.ru/profile/security), open the menu in the upper right corner (account number) and select **Profile**.
2. Go to the **Security and Login** section.
3. In the **Account login method** block, in the **Two-step authentication** row, click **Edit**.
4. In the **Backup codes** block, click **Create**.
5. To confirm the creation of backup codes, enter the user password. If you enter the password incorrectly three times, the session will be terminated and backup code creation will be locked for 24 hours.
6. Click **Confirm**.
7. Write down or print the codes — they will be hidden after the page refreshes. Store your backup codes in a safe place.

## Update backup codes \{#update-backup-codes}

If you have lost your backup codes or have used all of them, you can update them. Once updated, any previously created backup codes will no longer work.

1. In the [control panel](https://my.selectel.ru/profile/security), open the menu in the upper right corner (account number) and select **Profile**.
2. Go to the **Security and Login** section.
3. In the **Account login method** block, in the **Two-step authentication** row, click **Edit**.
4. In the **Backup codes** block, click **Update**.

## Change email for two-step authentication \{#change-phone-number-or-email-for-2fa}

<Tabs queryString="change-for-2fa">
  <TabItem value="account-owner" default>
    <TabItemLabel>
      For the account owner
    </TabItemLabel>

    1. [Change the email address](/account/change-profile.mdx#change-email).
    2. [Disable two-step authentication](#disable-two-step-authentication-if-there-is-access-to-control-panel).
    3. Re-enable [two-step authentication via email](#login-via-mail).
  </TabItem>

  <TabItem value="other">
    <TabItemLabel>
      For other users
    </TabItemLabel>

    Non-Account Owners cannot change their phone number — the user must be recreated. This can be done by the [Account Owner](/access-control/user-types.mdx#account-owner) or a user with the [`iam.admin`](/access-control/role-reference.mdx#iam-admin).

    1. [Delete the old user](/access-control/manage/disable-or-delete-user.mdx).
    2. [Add a user](/access-control/manage/add-user.mdx) with the new email address.
    3. [Enable two-step authentication via email](#login-via-mail).
  </TabItem>
</Tabs>

## Disable two-step authentication if you have access to the control panel \{#disable-two-step-authentication-if-there-is-access-to-control-panel}

Only the Account Owner can disable two-step authentication in the Control Panel.

1. In the [control panel](https://my.selectel.ru/profile/security), open the menu in the upper right corner (account number) and select **Profile**.
2. Go to the **Security and Login** section.
3. In the **Account login method** block, in the **Two-step authentication** row, click **Edit**.
4. Turn off the **Authenticator application** or **Email** toggle switch.
5. To confirm that you want to disable two-step authentication, enter the user password. If you enter the password incorrectly three times, the session will be terminated and disabling two-step authentication will be locked for 24 hours.
6. Click **Disable**.

## Disable two-step authentication if you do not have access to the control panel \{#disable-two-step-authentication-if-there-is-no-access-to-control-panel}

If you are the [Account Owner](/access-control/user-types.mdx#account-owner), two-step authentication can be disabled.

If you are not the Account Owner, contact the Account Owner — they must [remove you from the user list](/access-control/manage/disable-or-delete-user.mdx) and [add a new user](/access-control/manage/add-user.mdx) with the correct details.

<Tabs queryString="disable-2fa">
  <TabItem value="legals" default>
    <TabItemLabel>
      Legal entity
    </TabItemLabel>

    1. Prepare the following documents:

       * TIN/VAT of the organization;
       * A document confirming the authority of the person who signed the access restoration request (for the CEO, this is a copy of an order or an appointment decision; for other individuals, a power of attorney) ;
       * a request following the [template](https://files.selectel.ru/docs/ru/restore_access_disable_2fa_ru.docx);
    2. Email your documents to [payment@selectel.ru](mailto:payment@selectel.ru).
    3. If any questions arise, we will request additional documents.
  </TabItem>

  <TabItem value="individuals">
    <TabItemLabel>
      Individual or sole proprietor
    </TabItemLabel>

    1. Email your request to [support@selectel.ru](mailto:support@selectel.ru).
    2. We will send you questions about your account and your activity in it.
    3. Provide answers to the questions in as much detail as possible.
    4. If you provide over 80% correct answers, we will disable two-step authentication.
  </TabItem>
</Tabs>

<Formbricks />