Loading...
Security & 2FA
What protects your account: the authenticator app, email codes and new-device checks.
The authenticator app now guards sign-in
With an authenticator app enabled, your password alone no longer gets anyone in: after the password is accepted, signing in asks for the 6-digit code from your app before the account opens. Cancelling that box signs you back out, and refreshing the page does not skip it.
If you also have new-device checks on, the app code is asked for first and the emailed device code after it.
Setting up the authenticator
Open Profile → Account & security, find the Authenticator app row and press Turn on. Scan the QR code with Google Authenticator, Authy or 1Password (or copy the code underneath it), type the 6-digit code back in, and press Verify & enable.
There are no recovery codes. Keep the setup code somewhere safe, or use an authenticator app that backs itself up.
Email codes — this part does work
Changing your password or your email address sends a one-time code to your inbox that you have to type in before the change goes through. Codes expire in 10 minutes. Deleting your account is confirmed by typing DELETE instead of a code.
The Change email button sits on that same Profile → Account & security page, on the Email address row. Enter the new address and type the code sent to your current inbox. That does not move your sign-in email yet: VyroAI then sends a confirmation email to the new address ("Confirmation email sent to your new address."), and your sign-in email only changes once you press the link in it.
"Email code on every login"
On the same page, in the Extra checks block, is a row called Email code on every login, with an ON / OFF pill beside it and a Turn on / Turn off button. Turned on, every sign-in — recognized device or not — sends a 6-digit code to your inbox that you must type in before the account opens. It is the belt-and-braces option for an account you really cannot afford to lose; turned off (the default), the emailed code is only asked for by the new-device check.
Device alerts
When your account is used from a new device you get an email telling you the IP, the browser and when. It is a notice, not a button — there is no link in it that locks the account.
If it was not you, act yourself: change your password from Profile → Account & security, then remove the device under Where you are signed in — see Sessions & Devices.
Never share verification codes — VyroAI staff will never ask for them. Treat anyone requesting a code as a phishing attempt.
Also in Account & Billing
- Next in Account & Billing: Sessions & Devices
- Your account: Settings — There is no separate Settings page: it all lives under Profile → Preferences. What the General, Editor, Appearance and Creator sections each control.
- Your account: Two Accounts in One Browser — Add a second account and switch between them in one click — what "linked" means, why the credits do not pool, and what signing out takes with it.
- Your account: Connectors — Link GitHub and Discord to your account under Profile → Connectors, and what each link lets your projects do.
- Your account: Deleting Your Account — How to delete your data, what is removed, and what is kept.
3 of 31 in Account & Billing · Last checked 15 September 2026 · Previous: Creator Settings