I Lost Access To My Two-Step Verification
Use another method you set up, or one of your recovery codes, then set up two-factor protection again. With no method and no code left, the step cannot be skipped.
In the dashboard, two-step verification is called Two-Factor Protection. It turns on as soon as you add a passkey or verify an authenticator app. From then on, signing in with an email code or Google ends on a screen titled One More Step, which asks for one of those methods. This article covers what to do when you cannot provide it.
What The One More Step Screen Offers
The screen shows a tab for each method on your account.
- Authenticator App: the 6-digit code showing in your app.
- Passkey: confirmation on your device with Face ID, Touch ID, a PIN or a security key.
- Recovery Code: one of the codes you saved when you set up your authenticator app. This tab appears only while an authenticator app is set up and unused codes remain.
Under the tabs, Lost access to your methods? opens a short reminder, and Sign out and start over returns you to the sign-in page.
Use Your Other Method
- You lost your authenticator app but added a passkey. Select the Passkey tab, then Use Passkey. You can also start over, enter your email on the sign-in page and select Use a Passkey. A passkey you verify on your device needs no second step.
- You lost the device that held your passkey but still have your authenticator app. Select the Authenticator App tab and enter the current code.
- The screen says No passkey found on this device. The passkey may be saved on another device or in a password manager. Try the browser or device where you created it.
If an authenticator code is refused with That code didn’t match, enter the one showing right now: codes change every 30 seconds. After several wrong entries the screen makes you wait and shows a countdown.
Use A Recovery Code
Recovery codes are issued when you set up an authenticator app: a set of 10, each usable once, shown a single time with Copy All and Download .txt buttons. Look in your password manager, or for a file named flidu-recovery-codes.txt. An account protected only by a passkey has no recovery codes.
- On One More Step, select the Recovery Code tab.
- Type one code in the form XXXX-XXXX.
- Select Use Recovery Code.
You are now signed in to a restricted session. Most of the dashboard keeps working, but a banner lists what is blocked until you set up two-factor again: billing changes, ownership transfer or removal requests, disconnecting Google, removing security methods and regenerating recovery codes. Other account changes, such as changing your sign-in email, wait as well.
Set Up Two-Factor Protection Again
- Select Set Up Two-Factor Again in the banner. Profile Settings opens with two choices showing.
- Choose Add a Passkey or Set Up an Authenticator App.
- For a passkey: select Continue, confirm on your device, name the passkey and select Save Passkey.
- For an authenticator app: scan the QR code or enter the setup key, select I’ve Scanned It, type the 6-digit code from the app and select Verify and Enable.
Your existing methods are kept until the new passkey is saved or the new app’s code is verified, so cancelling changes nothing. A new authenticator app replaces the lost one at that moment. The restriction then lifts. If you added a passkey instead and the app you lost is still listed, select Remove on the Authenticator App card; its recovery codes stop working with it.
Afterwards, check the Recovery Codes card, which shows how many of the 10 codes remain. Select Regenerate for a new set. Flidu asks you to verify with your authenticator app or passkey first, and every older code stops working. Save the new codes before you select Done: they are not shown again.
If You Have No Method And No Recovery Code
There is no way around the One More Step screen. An email code does not replace it, recovery codes are never sent by email, and they cannot be viewed again after they were first shown. No link or email turns two-factor protection off.
What is left is to contact Flidu. Give the email address on the account and say which methods you have lost. Support reviews the account with you and has to verify that it is yours. An email on its own does not restore access, and recovery is not guaranteed, so treat this as a last resort.
Avoid Being Locked Out Again
- Set up both a passkey and an authenticator app, so one can stand in for the other.
- Keep your recovery codes in a password manager, and regenerate them when the Recovery Codes card warns that you are running low.
- Before you replace or reset a phone, sign in on another device and add a passkey there, or move your authenticator app to the new phone first.
What A Correct Result Looks Like
The Two-Factor Protection card in Profile Settings shows On, the banner about the restricted session is gone, and your next sign-in asks for a method you have with you.