Two-step verification, backup codes and passkeys
Two-step verification (2FA) means signing in needs your password and a six-digit code from an app on your phone. Your account controls real servers and real invoices, so we strongly recommend it. The dashboard shows whether it is on.
Turn it on
- Go to My Account and find Two-Factor Authentication (2FA).
- Choose Enable 2FA.
- Scan the QR code with an authenticator app such as Google Authenticator,
Authy or 1Password, or type the key in by hand. The account shows up as
vpsgb.co.uk. - Enter the six-digit code the app shows to finish.
Codes change every 30 seconds. If yours is refused, check the clock on your phone is set automatically.
Backup codes
As soon as 2FA is on, we give you 10 backup codes. Each one works once, in place of an app code. They are shown only once, so download them or write them down and keep them somewhere safe, away from your phone.
On the sign-in code page, choose Lost your device? to use one. You can make a fresh set on My Account at any time; doing so cancels the old set.
Remember this device
When you enter a code you can tick remember this device to skip the code on that browser for 30 days. You still need your password. Remembered devices are forgotten when you turn 2FA off or change or reset your password.
Passkeys
A passkey lets you sign in with your phone, fingerprint or security key instead of a password. Add one under Passkeys on My Account with Add a passkey. A passkey can also be used in place of the code on the two-step page.
Things that ask for your code again
- Creating an API token always asks for your password, and your current code if 2FA is on.
- Turning 2FA off cancels every API token on your account.
Lost your phone and your backup codes? Raise a ticket if you can still sign in another way, or contact us.