Register with your own email and a unique password
Registration and password changes accept passwords from 10 to 128 characters. Use a password manager to create and store a unique password rather than reusing one from another service. Protect the email account too, because it is part of your account identity.
New registration requires the six-digit code sent to your email. The code is valid for 10 minutes; a new request invalidates the previous code. Wait at least 60 seconds before requesting another and respect any longer limit shown on screen. Check spam folders and the address spelling before retrying. This registration code is different from the authenticator code used after enabling two-factor authentication.
Enable two-factor authentication and finish confirmation
Two-factor authentication is optional for both ordinary users and administrators. In account settings, enter your current password to start setup. Scan the QR code with a compatible authenticator app, or enter its setup secret manually, then submit the app's six-digit code to confirm. Scanning alone does not enable protection.
The setup QR code and secret can generate future authentication codes, so treat them as secrets. Keep them out of shared screenshots, chats and public QR-code websites. If setup expires or you start again, use the newest setup details rather than an earlier QR code.
Save the eight recovery codes before closing
Successful setup displays eight recovery codes once. Save them in a secure place you can access if your authenticator device is unavailable. Each code can be used once as the second login step after your password. Recovery codes do not replace the password, and used codes cannot be reused.
The account page can show how many codes remain, but it cannot display their original values again. A screenshot kept only on the same phone as the authenticator may not help if that phone is lost. If you lose both the authenticator and the unused recovery codes, contact the site's help area; do not assume access can be restored automatically.
If an authenticator code is rejected
Check that you selected the RaySMS entry in your authenticator and that the device uses automatic date and time. Codes rotate every 30 seconds. A code that has already been accepted cannot be reused, even if it is still visible in the app; wait for the next code or use an unused recovery code.
An expired login challenge requires a fresh password login. Repeated guesses can trigger a temporary limit, so follow the displayed message instead of repeatedly submitting. Disabling two-factor authentication requires your current password and a valid authenticator code or unused recovery code.
API keys need their own protection
An API key authorizes the supported API operations independently of browser two-factor authentication. Enabling or disabling 2FA does not revoke existing API keys. A key cannot manage 2FA, and losing a second factor does not turn the key into an account-recovery method.
Keep API keys on a trusted server or in a secret manager, not in public repositories, frontend JavaScript, URLs or support screenshots. Revoke a key that may have been exposed and update the affected integration. Changing your account password revokes existing API keys and other browser sessions, so prepare to replace the keys used by your software.
Support messages should contain only the relevant order ID and error context. Do not send passwords, authenticator secrets, recovery codes or full API keys.