How to enable Two-Factor Authentication

Turn on two-factor authentication so SiteSkite asks for a second code after your password. You can use an authenticator app (6-digit codes) or email (4-digit PIN). Optionally add passkeys for passwordless sign-in on trusted devices.

Open Two-Factor Auth settings

1. Sign in to the SiteSkite Portal.

2. Go to Profile → Two-Factor Auth (or open /2fa-settings).

Option A: Authenticator app (recommended)

1. Under Authentication method, select Authenticator App.

2. Scan the QR code with Google Authenticator, Authy, 1Password, Microsoft Authenticator, or another TOTP app. If you cannot scan, copy the Secret and enter it manually in the app.

3. Enter the 6-digit code shown in your app under “Test your 2FA code”.

4. Click Update two factor authentication to confirm.

When setup succeeds, you’ll see that the authenticator app is active. At the next login, SiteSkite will ask for a fresh 6-digit code from the app.

To rotate credentials later, use Regenerate my token, then scan the new QR code and confirm with a new 6-digit code. Update your authenticator app so old codes stop working.

Option B: Email PIN code

1. Under Authentication method, select Email.

2. Confirm the change (SiteSkite saves the method for your account).

At sign-in, after your password, you’ll see Check Your Email and enter the 4-digit PIN sent to your account email. Use Resend OTP if the message hasn’t arrived.

Keep inbox access reliable. If that email address bounces or you lose the mailbox, you may be locked out of SiteSkite until support can help recover the account.

Option C: Turn 2FA off

1. Select None under Authentication method.

2. Save / confirm the update.

Only password (or passkey) will be required after that. Turning 2FA off is not recommended for agency accounts that open client sites.

Add a passkey (optional)

1. On the same page, find Passkeys and security keys.

2. Click Add passkey and complete your browser / device prompt (Touch ID, Face ID, Windows Hello, or a hardware key).

3. Rename or remove passkeys anytime from the list.

On the login screen, use Sign in with passkey when a key is registered. Passkeys need a supported browser.

Verify it worked

• Sign out, then sign in again with email and password.

• Complete the second step (6-digit authenticator code or 4-digit email PIN).

• Check Account activity on the Two-Factor Auth page for the new sign-in.

Troubleshooting

• Invalid authenticator code — phone clock must be automatic/accurate; wait for the next 30-second code; regenerate the token if the secret was lost.

• Email PIN not arriving — check spam, confirm the account email is correct, click Resend OTP.

• Passkey failed — use a modern browser on a device with biometrics or a security key; registration cancelled in the OS prompt must be tried again.

Related

• Two-Factor Authentication in SiteSkite — overview of methods and impact