Account Security

Beyond your password, BazaarLink also supports two-step verification for an extra layer of protection at sign-in.

Enable two-step verification (TOTP)

Go to the Settings page and find the "Two-step verification (TOTP)" section, then click "Enable two-step verification."
Scan the QR code with an authenticator app (such as Google Authenticator), or enter the secret shown below manually.
Enter the 6-digit code your authenticator generates and confirm to finish enabling it.

Once enabled, you'll see 8 backup codes shown only once — each is 10 characters and works only once. Save or copy them somewhere safe other than your phone; use a backup code to sign in if you lose your phone or can't reach your authenticator.

Signing in after enabling

From then on, every sign-in requires a code from your authenticator app (or a backup code) in addition to your password (or Google sign-in).

Other ways to protect your account

Combine these with two-step verification to further limit the damage from a leaked or misused key:

IP allowlist — restrict an API key to specific source IPs.
Personal circuit breaker — set per-minute and per-hour spend caps that pause automatically once exceeded.
Per-key spend limit — set a daily, weekly, or monthly spend cap when creating or updating an API key.