Using Two-Factor Authentication (2FA) with Google Authenticator

Using Two-Factor Authentication (2FA) with Google Authenticator

Overview

Control Center supports Two-Factor Authentication (2FA) to keep your account secure. By default, the system uses Email OTP (a one-time code sent to your email) as the verification method. You can also enable Google Authenticator (or another TOTP-compatible authenticator app) as an additional verification option.

Once Google Authenticator is enabled, you can choose to verify your login using either:
  1. Email OTP, or
  2. Authenticator App OTP
This article explains how the login flow works, how to enable Google Authenticator, how to use recovery codes, and what to do if you lose access to your authenticator device.

1. How the Login Flow Works

  1. Enter your email and password on the login screen.
  2. The system validates your credentials.
  3. If Email OTP is the only enabled method, you will be taken to the Email OTP verification screen.
  4. If Google Authenticator is also enabled, you can switch between Email OTP and Authenticator App verification.
  5. After successful OTP verification, your login is completed and your authenticated session is created.
Notes
Note: You are not fully logged in until the second factor is verified.

2. Verification Screens You May See

Screen
Purpose
Main Actions
Email OTP Verification
Default login verification method.
Enter Email OTP, resend OTP, remember trusted device, set default verification method, and switch to Authenticator (if available).
Authenticator Setup
Allows verified users to enable Google Authenticator.
Show the QR code, show the manual secret, accept the 6-digit authenticator code, and verify and enable.
Authenticator Enabled Summary
Shows enabled status and recovery options.
Download/copy/regenerate recovery codes, and disable the authenticator using the password and current authenticator code.
Authenticator Login Verification
Used after login credentials when authenticator is enabled.
Enter a 6-digit authenticator code, use Email OTP instead, use a recovery code, remember the trusted device, and set the default method.

3. How to Enable Google Authenticator

  1. Log in normally using Email OTP.
  2. The Secure your account pop-up window will be displayed.
Figure 1.0                                                                
  1. Click on the "Enable Now" button.
Figure 1.1                                                                                                                                
  1. Click on the "Enable Two-Factor Authentication" button.
Figure 1.2                                                                                                                  
  1. The system generates a unique TOTP secret and displays a QR code and a manual secret.
  2. Scan the QR code using Google Authenticator or another TOTP-compatible app. 
  3. Enter the current 6-digit code from your authenticator app.
  4. If the code is valid, the system marks Authenticator as enabled and displays your recovery codes.
Figure 1.3                                                                                                                                            
Alert
Important: Google Authenticator is only marked as enabled after the first code is verified successfully.

4. Recovery and Fallback Options

  1. Email OTP remains available as the default fallback method.
  2. Recovery codes are generated when Authenticator is enabled. Use them if you lose access to your authenticator device.
  3. Each recovery code is single use only.
  4. You can download, copy, or regenerate recovery codes from the Two-Factor Authentication page.
  5. Disabling Authenticator requires both your current password and a valid current authenticator code.

5. Frequently Asked Questions

Q: Can I still use Email OTP after enabling Google Authenticator?
A: Yes. Email OTP remains available as a fallback method.

Q: What if I lose my phone or authenticator app?
A: Use one of your recovery codes to log in. Each code can be used only once. You can also regenerate recovery codes from the Two-Factor Authentication page.

Q: How do I disable Google Authenticator?
A: Go to the Two-Factor Authentication page. Disabling requires your current password and a valid current authenticator code.

Q: What happens if I enter an invalid OTP?
A: Invalid attempts are rejected and rate limited for security.

Q: Is my authenticator secret stored securely?
A: Yes. Google Authenticator secrets are stored encrypted at rest.