Set up two-factor authentication

SleeveFolio uses TOTP: the standard 6-digit codes from an authenticator app (1Password, Google Authenticator, Authy, and friends). 2FA protects every sign-in once enrolled, and it’s one of the two safety checks the Paper → Live gate requires.

1. 1
   Scan the QR code

   Open Settings → Account and start enrollment on the two-factor card. A QR code appears. Scan it with your authenticator app (or type the setup key in manually).

2. 2
   Verify a code

   Type the 6-digit code your app shows. This confirms your app was set up correctly before 2FA is switched on.

3. 3
   Store your recovery codes

   Ten one-time recovery codes appear, once. Download or copy them somewhere safe. They’re your way in if the authenticator device is lost. Details in Recovery codes.

What changes after enrollment

• Every sign-in (magic link, Google, GitHub) is challenged for a code before you’re signed in
• Sensitive actions — enabling live trading, placing an order by hand (including a holding’s Close button), turning on auto-execute, saving or disconnecting broker keys, and deleting your account — require that your signed-in session has passed 2FA before they go through. The check happens on SleeveFolio’s side, so it can’t be skipped. Winding down is the exception: pausing, liquidating, or reverting to paper is never gated, so you can always get out of live
• The gate’s 2FA check turns green

Disabling 2FA

Turning 2FA off requires your current authenticator code (re-entering it is the re-authentication). Because 2FA is one of the gate’s two conditions, disabling it while you’re live also reverts your account to paper in the same step: the PAPER/LIVE indicator in the top bar drops back to PAPER, live auto-execute (automatic trading on your live account, including the hourly crypto safety check’s live protective sells) switches off, and the change lands in your audit log (turning 2FA on or off is always recorded there, live or not). The two-factor card tells you this before you confirm. Going live again means re-enrolling 2FA and then the full enable-live ceremony; live auto-execute is a separate opt-in after that. Nothing re-arms on its own.