With two-step login, signing in needs your password and a 6-digit code from an app on your phone. Someone who learns your password, or gets into your email, still can't reach your domains and servers.
Turn it on
- Install an authenticator app: Google Authenticator, Microsoft Authenticator, 1Password, Authy or any app that supports TOTP codes.
- Open Dashboard → Security and scan the QR code with the app. If you can't scan it, type the key shown under the code.
- Enter the 6-digit code the app shows. Two-step login is now on.
- Save the 10 recovery codes shown next. They are shown only once. Keep them somewhere other than your phone, such as a password manager or on paper.
This works the same when you sign in with Google: after Google, we ask for the code.
Signing in
After your password, enter the code your app shows. A new code appears every 30 seconds. Tick “Don't ask again on this device for 30 days” on your own computer to skip the code there. You can forget all remembered devices on the Security page.
Some actions, like creating an API key or connecting an app, ask for a fresh code even on a remembered device.
The code is always wrong
The codes depend on your phone's clock. Turn on automatic date and time in your phone's settings, then try a new code.
After 5 wrong codes, signing in is paused for 15 minutes. Wait, then try again.
A new phone
Many apps can move your codes to the new phone. If yours can't: while you still have the old phone, sign in, turn two-step login off on the Security page, and turn it on again with the new phone.
A lost phone
Enter one of your recovery codes instead of the 6-digit code. Each recovery code works once, and we email you when one is used. Then, on the Security page, turn two-step login off and on again with your new phone, or get new recovery codes.
No phone and no recovery codes
Write to info@nameocean.net from the email address of your account. Access to your email alone is not enough: we will ask for details about your account that aren't public, and we reset two-step login 24 hours after the check, so the real owner has time to stop it. We never do this over the phone or social media.
A reset also removes your API keys and connected apps. Create a new key and reconnect your apps afterwards.
API keys and connected apps
An API key or a connected app (the MCP server or the nameocean CLI) can manage your account without a password, so they need two-step login. You can create an API key or connect an app only with two-step login on.
From 20 November 2026, existing API keys and connected apps stop working on accounts without two-step login. Turning it on makes them work again.
Turning two-step login off deletes all your API keys and connected apps.