How to Enable Two-Factor Authentication on UniLink (Secure Your Account)

Two-factor authentication adds a second layer of protection so your account stays safe even if someone gets hold of your password. This guide covers setup, backup codes, and recovery.

A password alone is no longer sufficient protection for any account that matters. If your password is reused across sites, guessed by a brute-force attack, or exposed in a data breach, anyone who obtains it can log in to your UniLink account, access your subscriber list, tamper with your store, or lock you out by changing your email. Two-factor authentication (2FA) prevents this by requiring a second piece of evidence — a time-sensitive code from an app on your phone — that an attacker would need physical access to your device to produce.

What Two-Factor Authentication Covers

UniLink's 2FA uses the Time-based One-Time Password (TOTP) standard. This means it works with any standard authenticator app, including Google Authenticator, Authy, Microsoft Authenticator, and 1Password. You do not need any specific app — all TOTP apps generate the same valid codes for any given account.

Once enabled, every login from a new or unrecognized device requires your password plus a 6-digit code from your authenticator app. The code refreshes every 30 seconds and is valid only for one login attempt. An attacker with only your password cannot log in without also having your phone.

When you set up 2FA, UniLink provides a set of one-time backup codes. These are used when your phone is unavailable — for example, if it is lost, stolen, or out of battery. Each backup code works exactly once. After use, it is invalidated. Store your backup codes somewhere secure and separate from your phone, such as a printed sheet in a safe location or inside a password manager.

How to Get Started

1. Log in to your UniLink account — Go to unil.ink/login and enter your credentials. 2FA setup requires an active session.
2. Open Settings → Security — Click your profile avatar in the top-right corner of the dashboard, select "Settings", then navigate to the "Security" tab.
3. Click "Enable Two-Factor Authentication" — A setup modal opens with a QR code and a text-based secret key below it.
4. Open your authenticator app — Install Google Authenticator, Authy, or any TOTP-compatible app on your phone if you do not have one yet. Tap "Add account" or the "+" button.
5. Scan the QR code — Point your phone camera at the QR code shown on the UniLink setup screen. The app adds a "UniLink" entry with your email address and starts generating 6-digit codes.
6. Enter the current 6-digit code — Type the code shown in your authenticator app into the verification field on the UniLink setup screen. You have 30 seconds before it refreshes — if you are slow, just wait for the next code. Click "Confirm".
7. Save your backup codes — UniLink displays 8–10 one-time backup codes. Download the text file or copy them to a password manager. Click "Done" to complete setup.

Step-by-Step Guide

1. Choose Authy over Google Authenticator if you can — Authy backs up your 2FA accounts to the cloud (encrypted), so you can restore them on a new phone. Google Authenticator requires manual transfer. Either works, but Authy reduces the risk of being locked out if your phone is lost.
2. Use the manual entry key if the QR code does not scan — Below the QR code, UniLink shows a text-based secret. In your authenticator app, choose "Enter setup key manually" and type or paste the secret. The result is identical to scanning.
3. Verify the code successfully before closing the setup modal — 2FA is not active until you enter a valid code and click "Confirm". If you close the modal without confirming, 2FA is not enabled and you need to start from step 3.
4. Store backup codes in at least two places — A printed copy in a physical safe and a digital copy in a password manager is the standard approach. Storing them only on your phone defeats their purpose — if you lose the phone, you need the codes to get back in.
5. Test the login flow immediately after setup — Log out and log back in to confirm that the 2FA prompt appears and your authenticator code is accepted. This confirms setup worked before you rely on it.
6. Do not screenshot the QR code and store it in your phone's camera roll — If your phone is compromised, the attacker gets access to both your stored passwords (if any are in the browser) and the 2FA secret. Store the backup codes separately instead.
7. Regenerate backup codes periodically — In Settings → Security, you can invalidate old backup codes and generate a fresh set. Do this if you have used several codes or if you suspect someone may have seen them.

Key Settings Explained

How to Get the Most Out of It

Enabling 2FA is one of the most effective security actions you can take for your UniLink account, but it is only as strong as your backup codes management. The most common way people lose access to a 2FA-protected account is not an attack — it is losing their phone without having backup codes stored elsewhere. Treat backup codes with the same seriousness as a spare house key.

If you manage a UniLink account for a brand or team, consider the operational implications of 2FA. If only one person has the authenticator app and they leave the team or lose their phone, the rest of the team may be locked out. Use a shared authenticator entry in a team password manager like 1Password Teams or Bitwarden Organizations so multiple trusted people have access to the code generator.

Combine 2FA with a strong, unique password for maximum protection. A long, random password from a password manager plus 2FA means an attacker would need to break strong cryptography AND physically steal your phone to access your account. In practice, accounts with both protections are never targeted because easier targets exist.

Review your active sessions periodically in Settings → Security → Active Sessions. If you see a location or device you do not recognize, use "Log out of all devices" to clear everything, then change your password and confirm your 2FA setup is still intact. This combination — forced logout, password change, 2FA active — is the complete response to a suspected unauthorized access event.

Troubleshooting Common Issues