---
slug: zwei-faktor
title: "Set up two-step verification"
category: konto
locale: en
updated: 2026-10-16
keywords: ["two-factor","2FA","TOTP","authenticator","passkey","sign-in","security"]
questions: ["How do I protect my account beyond the password?","Two-factor authentication","Set up 2FA","How do I protect my account?","Connect an authenticator app","I lost my phone","Passkey as a second factor"]
url: https://bench.metrunio.com/en/help/zwei-faktor
---

# Set up two-step verification

**How do I protect my account beyond the password?**

In the settings you set up a code from an authenticator app or a passkey. After your password, sign-in then asks for the code or the passkey. Ten recovery codes cover the case where you have neither at hand.

Your account sees budgets, revenue and, through conversion forwarding, the credentials for the ad platforms. A password alone is not enough for that: it can be guessed, intercepted or carried over from another service. An additional code from the app protects your account if someone only knows your password. It is valid only briefly and works only once.

1. Open the settings and choose “Set up” under “Two-step verification”.
2. Enter the secret shown into your authenticator app, or scan the address as a QR code.
3. Enter the six-digit code from the app and switch it on.
4. Write down the ten recovery codes and keep them separate from your phone.

> **Caution:** The recovery codes appear exactly once. What we store is their checksum; we cannot show them again later. Without them and without your phone you will not get back into your account.

Instead of the app, or in addition to it, you can add a passkey. It counts as a second step in the same way: your first passkey switches on two-step verification, even without the app, and you get ten recovery codes if you have none yet. It also signs you in without a password. How that works is explained in “Sign in with a passkey”.

## What to know

- The code in the app changes every thirty seconds; each one can be used only once.
- If your phone’s clock is wrong, the codes will not match. Set it to automatic time.
- Each recovery code works exactly once; the settings show how many are left.
- Switching it off needs your password and a code: a hijacked session alone should not remove the protection.
- Switching it on and off is recorded in the change log of every tenant you belong to, and its admins see it.

> **Caution:** A one-time code can be phished too: a fake sign-in page can ask for your password and code and pass both on at once. So enter the code only on the genuine Metrunio sign-in page and never in an email, a chat or on the phone, not even if someone claims to be support. We never ask for it.

The setting applies to your account, not to the tenant. Everyone decides for themselves, and should decide in favour.

## Also asked

- Two-factor authentication
- Set up 2FA
- How do I protect my account?
- Connect an authenticator app
- I lost my phone
- Passkey as a second factor

## Related

- https://bench.metrunio.com/en/help/passkeys
- https://bench.metrunio.com/en/help/wiederherstellungscodes
- https://bench.metrunio.com/en/help/passwort-und-anmeldung
- https://bench.metrunio.com/en/help/rollen-und-rechte
- https://bench.metrunio.com/en/help/audit-log