Two-Factor Authentication - SEND Docs

What Changes When 2FA Is On

With two-factor authentication enabled, a correct username and password is no longer enough. After the password check succeeds the server issues a short-lived challenge instead of tokens, and you finish signing in with a code from your authenticator app.

SEND uses standard time-based one-time passwords, so any RFC 6238 authenticator works.

The entry your authenticator creates is labelled with the issuer "ChainKit", the platform SEND runs on. That is expected -- it is your SEND account.

Codes are 6 digits and rotate every 30 seconds
The previous and next windows are also accepted, giving roughly 90 seconds of tolerance for clock drift
Parameters are SHA-1, 6 digits, 30-second step -- the defaults every authenticator app expects

Turning 2FA On

Open Settings > Security and choose Enable 2FA. Setup runs as a three-step modal.

Two-factor is not active until step 2 succeeds. Abandoning setup at the QR screen leaves your account exactly as it was, with two-factor still off.

SEND generates a secret and renders it as a QR code. If you cannot scan, the same secret is shown as text with a copy button for manual entry.
Enter the 6-digit code your app produces. The field submits automatically once all six digits are filled, and clears itself if the code is rejected.
SEND shows 10 backup codes. This step cannot be dismissed until you acknowledge it -- closing the modal is intercepted and prompts you to save the codes first.

Backup Codes

Successful verification issues a fresh set of 10 backup codes. Each one substitutes for an authenticator code exactly once.

Backup codes are shown once, at the end of setup. There is no regenerate action -- the only way to obtain a new set is to disable two-factor authentication and enrol again.

Format is XXXX-XXXX, using uppercase letters and digits
The hyphen is cosmetic and matching is case-insensitive -- abcd-efgh, ABCDEFGH and abcdefgh are all the same code
A code is consumed the moment it is accepted and is removed from your account
Codes are stored as Argon2id hashes, so SEND cannot display them to you again

Signing In With 2FA

Submit your username and password as usual. Instead of signing you in, the server returns a challenge and the sign-in page swaps to a code entry form.

Being asked for a code is not an error, and SEND does not surface it as one. If the challenge expires, sign in again to get a new one.

The challenge is valid for 5 minutes and can be redeemed only once
Enter the 6-digit code from your app, or use the toggle to enter a backup code instead
Back discards the challenge and returns you to the sign-in form
A client that already has a code can send it alongside the username and password and skip the challenge step entirely

Turning 2FA Off

Settings > Security > Disable 2FA requires both your account password and a current 6-digit code from your authenticator. The confirm button stays disabled until both are supplied. Disabling clears the stored secret and every remaining backup code.

A backup code is not accepted for disabling. If you lose your authenticator you can still sign in using a backup code, but you cannot switch two-factor off without a live code from the app -- so keep either the app or a way to restore it.

Checking Your Status

Settings > Security shows whether two-factor is enabled and whether any backup codes remain unused. That badge reads the live server state rather than a cached copy of your profile, so it is accurate immediately after you enable or disable it.