Service setup
How to enable two-factor authentication for Cloudflare
Start in your profile's authentication settings, enroll an authenticator and save recovery codes for your account.
Open Authentication in the Cloudflare profile you want to protect, add an authenticator and confirm with a generated code. Save the recovery codes, then try an ordinary sign-in.
In this article
Check which Cloudflare user is signed in
A Cloudflare user can belong to several accounts and sites. Enabling a sign-in method for that user is not the same as configuring every member of a selected domain.
For teams, check authorized backup administration. Do not share one person's setup secret as a workaround for changing an authenticator; colleagues should use their own approved identities.
Open authentication settings and add an authenticator
In the profile's authentication settings, choose the available authenticator-app method, add the setup material and return the required code and confirmation.
Use enrollment material only in the flow you initiated. Do not send it to an unsolicited ticket claiming to fix a domain problem.
Save recovery codes after setup
Preserve the fallback codes supplied during setup and check that you could retrieve them after a phone failure. Another authenticator cannot rebuild a secret from a service name alone.
When replacing an app, check the reconfiguration process and when the previous enrollment stops working. Test the replacement and update your inventory and recovery records.
Organize web sign-in and API tokens separately
Manage two-factor web sign-in and API tokens separately. Scope API tokens to their task, record where they are used, and revoke them when retired.
Keep web sign-in codes in Authenticator Cloud. If you manage Cloudflare on a computer, use the extension to copy or fill a code. With Pro and a completed sync, the same entries are available on your phone.
References
See the official guides above for detailed setup instructions.
Add the entry to Authenticator Cloud, find the account by email and copy its code when you sign in.
