Sign-in, 2FA and verification codes
Secure operator access
Every authenticated user owns their personal Profile and Password & 2FA settings. Account configuration is more restricted, but account security is available to operator admins, permitted staff, agents, affiliates, and platform users for their own sign-in.
This page is about signing in to the operator console. Your subscribers sign in to the customer portal differently; see Portal access and profile.
Where each code comes from
| Code | Where it comes from |
|---|---|
| The 6-digit code asked for after your password | Your authenticator app. Centipid never sends it by SMS or email. |
| A recovery code | The list you saved when you turned on 2FA. Each one works once. |
| A magic sign-in link | Email. Choose Continue with magic link on the sign-in page. Only Admin accounts can use it. The link works once and expires after 15 minutes. |
| A verification code before a sensitive action | Your passkey or authenticator app if you have one, otherwise a 6-digit code emailed to the address on your own profile. It expires after 5 to 10 minutes, depending on the action. |
Sensitive actions include deleting a router, adding, editing or removing staff, resetting a staff password, requesting a withdrawal, and changing the payment gateway.
When a code does not arrive
- Sign-in 2FA code: nothing is sent. Open your authenticator app and type the current code. If you no longer have the app, choose use a recovery code on the same screen.
- Emailed verification code or magic link: check that the email on Settings → Profile is correct, and look in spam or quarantine. Wait about a minute before asking again; asking repeatedly locks requests for up to 15 minutes. If email is unreliable for you, turn on 2FA or add a passkey, and the dialog asks for those instead.
- Code rejected: make sure your phone sets its clock automatically. Five wrong codes in a row lock code checks for 15 minutes.
Who has to use 2FA
Two-factor is optional for Admin and Support staff. Other staff account types are sent to Password & 2FA and cannot use the console until they set it up. Signing in with a passkey counts as the second factor.
Update the password
- Open the user menu and choose Settings.
- Select Password & 2FA.
- Enter the current password.
- Enter and confirm a long, unique new password that satisfies the form rules.
- Save the change and confirm the success message.
Use a password manager. Do not reuse the router password, email password, provider dashboard password, or an API key.
If the current password is rejected, use password recovery rather than repeatedly guessing. A user already signed in through an impersonation or support workflow should return to their own account before changing credentials.
Enable two-factor authentication
Start setup
In Password & 2FA, choose to enable two-factor authentication. The setup dialog presents an authenticator secret or QR code.
Enroll an authenticator
Scan the QR code with a trusted TOTP authenticator. Do not photograph it, paste it into chat, or send it in a ticket.
Verify the code
Enter the current authenticator code to complete setup. If a code fails, confirm the device clock is set automatically and try the next generated code once.
Store recovery codes
Save the recovery codes outside the device that holds the authenticator. A password manager or controlled offline record is appropriate. Each code should be treated like a password.
Add a passkey
The security page can register a passkey backed by Face ID, Touch ID, Windows Hello, Android screen lock, or a hardware security key, depending on browser/device support.
- Choose Add passkey.
- Follow the browser or operating-system prompt.
- Give the credential a recognizable device context if prompted.
- Test sign-in before relying on it as the only convenient authentication method.
A passkey does not remove the need to retain controlled recovery access. Browser private mode, remote desktops, and older devices may not expose the required authenticator.
Recovery and lockout
Lost authenticator but recovery codes available
Use one recovery code at the two-factor challenge, sign in, remove the lost authenticator, enroll a new one, and regenerate recovery codes.
Lost authenticator and no recovery codes
If you have a passkey on this account, sign in with it, then set up 2FA again. Otherwise contact Centipid support. Your own ISP admin cannot remove 2FA from a staff account; only Centipid support can, after checking who you are. After it is removed, set it up again at your next sign-in. Support should never ask for your password, API keys, router secrets, or payment-provider secrets.
Forgot which email or domain you signed up with
Open /recover on the main Centipid site. The registration page also links to it (Recover your account) when you try to register an email or phone that is already in use. Prove you own the email or phone number you registered with, using a one-time code, and you can reset the admin password for your ISP.
Password-reset email does not arrive
Confirm the address, check spam/quarantine, and avoid repeated rapid submissions. Record the timestamp and error if escalation is needed.
Staff and shared access
Never share the owner account. Create a separate staff identity and grant only the permissions needed for the role. When a staff member leaves, remove or disable their access and review API tokens, webhooks, payment credentials, and router access they managed.
See Staff and permissions and Settings.