The email verification code (and the authenticator app)

In short. Your license key gives access to your product: the site does not show it lightly. Before a sensitive action, it checks it is really you by sending a 6-digit code by email, to your confirmed address. Nothing to turn on: it is the default check.

When the code is asked #

• showing your license key, or downloading the .env file or the panel egg (they contain your key);
• requesting a refund;
• renewing or managing a subscription, opening the Stripe billing portal;
• confirming or canceling a tier change (Basic ↔ Pro): confirming charges your card right away;
• choosing your reward for the 10th referral (one-time, final choice, see Referrals);
• turning on the authenticator app (see below);
• changing your account's address.

Receive and enter the code #

1. Do the action (for example Show the key). The site tells you which address it will write to.
2. Click Send me a code.
3. Open the email and enter the code. It is valid for 10 minutes and works once. You can paste it as is, with its space ("123 456").
4. You come back to the page and the site tells you ("Verification done: nothing has been done yet"). You still have to click the button of the action again, this time it goes through.

A new code cancels the previous one. You can ask for 3 per 15 minutes and 10 per 24 hours (per account). After 5 wrong tries, the code is cancelled: ask for a new one. At each mistake, the screen tells you how many tries are left ("3 attempts left before this code is cancelled").

If you opened two tabs and one of them has already done the verification, the other simply lets you continue: no code is used up.

Not working? #

Going further: the authenticator app #

In My account → Security, you can turn on two-factor authentication with an app (Google Authenticator, Authy, 1Password, Bitwarden...): you scan the QR code, enter a first code, and write down the 8 recovery codes (shown only once, each usable once). Once on, the app's code is what is asked, and the email code stays available as a fallback ("Get a code by email instead"). The code comes from your phone, without going through your mailbox: it is safer.

Turning on the app first requires a verification. If your address is confirmed, the site first sends you an email code before showing the QR code, then brings you back to the setup: without that, someone who borrowed your session could enroll their own phone.

Too many wrong codes #

After 5 wrong app codes in a row, entry is blocked for 15 minutes. Each new series of 5 wrong codes lengthens the block: 15 minutes, then 1 hour, then 24 hours. Only an accepted code (app or recovery code) resets the counter. During a block, the screen says so ("…app codes blocked for N h. A recovery code still works."): a recovery code is still accepted, it is the owner's way out. If you have none left, open a ticket.

The two ways each have their own block: a block on the app does not grey out Send me a code (that is the fallback), and the limit on email codes sent does not block entering an app code. The screen counts the delays by itself: the button reopens when the block ends, without reloading the page.

The Agora team #

Agora team accounts are held to a stricter rule: the authenticator app is mandatory (the email code is not enough) and their session lasts only 12 hours from sign-in, instead of being extended at each use.