Two-Factor Authentication

Two-Factor Authentication

Two-factor authentication (2FA) protects your panel account even if your password leaks. VinzaPanel supports two kinds of second factor:

• Authenticator app (TOTP) — a 6-digit code that changes every 30 seconds and works offline (Google Authenticator, Authy, 1Password and similar apps).
• Passkeys — sign in with your fingerprint, Face ID, Windows Hello or a hardware security key. Passkeys are phishing-resistant, and you can register more than one (for example laptop and phone).

2FA is optional for every account. Administrators who have not set it up see a recommendation on the dashboard, which they can dismiss — but we strongly recommend turning it on for every admin account.

Turn on an authenticator app

1. Open the user menu (top right) → Profile. In the Two-Factor Authentication card, click Set up next to Authenticator App.
2. Click Generate Secret. A QR code appears.
3. Scan the QR code with your authenticator app, or type the key shown under Or enter this key manually.
4. Enter the current 6-digit code and click Confirm & Enable.

From now on, after your password the panel asks for the 6-digit code from your app.

Add a passkey

1. In the same card, click Set up next to Passkey (it opens the same page). Under Passkeys (biometric / security key), click Add a passkey.
2. Give it a name (e.g. My Laptop) and confirm with your device.

On the login page, click Sign in with a passkey — no password or code to type.

Turn 2FA off or change devices

• Disable 2FA removes the authenticator secret from your account. You can enable it again at any time.
• Regenerate Secret creates a new QR code, for example when you move to a new phone. Confirm it with a fresh code.
• Remove a passkey you no longer use with its Remove button.

2FA and API tokens

API tokens (Profile → API Tokens) do not ask for a second factor, so create tokens from an account that is protected with 2FA and restrict them to the IPs that need them. See Provisioning API (billing systems).