Two-factor authentication (2FA) adds a 6-digit code from an authenticator app on your phone to every login, on top of your magic link or password. Turn it on in Settings › Sign-in security. It protects your own login only. Everyone on your team sets it up for themselves, and it applies to every Wrapped account you log in to with that email address.
Turn on two-factor authentication
- Go to Settings › Sign-in security.
- Under Two-factor authentication, select Turn on.
- Install an authenticator app on your phone if you don't have one: Google Authenticator, Authy or Microsoft Authenticator.
- In the app, tap + and scan the QR code shown in Wrapped.
- Enter the 6-digit code the app shows, and select Verify and turn on.
- Wrapped shows your Recovery codes. Select Copy codes and keep them somewhere safe, such as a password manager. Then select Done.
The setting now shows On, and the Sign-in security tile on the Settings page says "Two-factor authentication is on".
There's no option to type a setup key by hand. You need to scan the QR code with your phone.
If you're a Member or Read-only user, you don't see Settings in the sidebar. Go to manage.wrappedgiftcards.com/settings/account and use the Sign-in security section there.
Log in with two-factor authentication
- Log in as usual with a magic link or your password.
- On the Two-factor authentication screen, enter the 6-digit code from your authenticator app. It's checked as soon as you enter the sixth digit.
- If you can't use your app, select Use a backup code, enter one of your recovery codes, and select Submit backup code.
Recovery codes
- You get 10 recovery codes when you turn on two-factor authentication.
- Each code works once. A used code is removed from your list.
- To see your remaining codes, go to Settings › Sign-in security and select Recovery codes.
- If you turn two-factor authentication off and on again, you get a new set of codes.
Turn off two-factor authentication
- Go to Settings › Sign-in security.
- Select Turn off.
- Confirm with Turn off.
Turning it on and off is recorded in the audit log.
Common questions
Can I require two-factor authentication for my whole team?
No. Each person turns it on for their own login, and Owners and Admins can't turn it on or off for someone else. The Sign-in security tile shows a Recommended badge while yours is off, so ask your team to set it up.
I lost my phone. How do I log in?
Use one of your recovery codes: on the two-factor screen, select Use a backup code. Once you're in, turn two-factor authentication off and on again to set it up on your new phone. If you've lost your phone and your recovery codes, contact the Wrapped team. See Getting help from the Wrapped team.
"Unable to verify code" - what's wrong?
Codes change every 30 seconds, so enter the one showing right now. If codes keep failing, make sure your phone's date and time are set automatically, because authenticator codes depend on the clock.
I have access to several Wrapped accounts. Do I set it up for each one?
No. Two-factor authentication belongs to your login (your email address), so it covers every Wrapped account you can access.
Does it apply to the Redeem app or API keys?
No. Two-factor authentication protects dashboard logins. Redeem app staff logins and API keys are managed separately. See The Wrapped Redeem app and Create and manage API keys.
Does it replace magic links or passwords?
No. It's an extra step after your magic link or password.