Two-factor authentication
Enrolling
Section titled “Enrolling”Two-factor authentication uses TOTP: any standard authenticator app
works. Enrollment gives you a secret and an otpauth:// URI as selectable
text (no QR code to scan, so it works even without a camera pointed at the
screen), plus ten one-time recovery codes. Save the recovery codes
somewhere separate from your password: they’re the only way back into
your account if you lose access to your authenticator app.
Logging in once it’s enabled
Section titled “Logging in once it’s enabled”Login becomes a two-step process: your password alone no longer signs you in. A correct password issues a short-lived, single-use pending token instead of a session; you still need to supply a valid TOTP code (or a recovery code) against that pending token before a real session is created. That pending token is capped at five wrong code attempts and only works at the one login-completion step it was issued for.
Recovery codes
Section titled “Recovery codes”Each recovery code works once. Using one to log in consumes it; generate a fresh set from your account’s security settings once you’re back in, rather than running out unnoticed.
Managing sessions
Section titled “Managing sessions”Your account’s security settings also list every active session and let you revoke any of them individually, useful after using a recovery code, or if you think a session isn’t yours anymore.
Trusted devices
Section titled “Trusted devices”During TOTP login, you can check Remember this device for 30 days. Proxploy stores a secure cookie on that browser; for the next 30 days, logins from that device skip the TOTP step. This is per-device, not per-session: clearing cookies or using a different browser removes the trust and TOTP is required again.
Your profile’s security settings list every trusted device and let you revoke any of them individually.