Account & security

8–64 bytes. Emoji and some other characters use more than one byte.

Setup uses a six-digit code that changes every 30 seconds. Your app must support time-based (TOTP), SHA-1 codes.

Add this account to your authenticator app

Choose manual entry, name the account eSoya, and enter this setup key. Use time-based codes (SHA-1, six digits, 30 seconds). We never send this key to another service.

The key may wrap onto two lines. Copy the entire field; wrapping does not add characters.

Enabling signs out other browsers and cancels older password-reset links. The next screen shows ten recovery codes once. Save them before leaving.

Replacement invalidates every old code and signs out other browsers. Disabling erases the authenticator and all recovery codes, and signs out every browser, including this one. Both cancel outstanding password-reset links. Shop API keys are managed separately.

Use a fresh authenticator code; a code already used to sign in cannot be reused.