> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ariacompute.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable two-factor authentication for your account

> Turn on TOTP-based two-factor authentication for your Aria Compute account, manage active sessions, and revoke stolen or unused logins.

Two-factor authentication (2FA) protects your Aria Compute account with a rotating six-digit code from an authenticator app. This guide covers enabling 2FA, signing in afterwards, and managing your active sessions.

## Enable 2FA

<Steps>
  <Step title="Start the setup">
    ```bash theme={null}
    curl -X POST https://ariacompute.com/api/auth/2fa/setup \
      -H "Authorization: Bearer eyJhbGciOi..."
    ```

    The response contains the TOTP `secret` and a `qr_code_url` you can render in your dashboard.
  </Step>

  <Step title="Add the account to your authenticator app">
    Scan the QR code (or paste the secret) into Google Authenticator, 1Password, Authy, or any TOTP-compatible app.
  </Step>

  <Step title="Confirm the code">
    ```bash theme={null}
    curl -X POST https://ariacompute.com/api/auth/2fa/enable \
      -H "Authorization: Bearer eyJhbGciOi..." \
      -H "Content-Type: application/json" \
      -d '{"code": "123456"}'
    ```

    A successful call activates 2FA on the account.
  </Step>
</Steps>

## Sign in with 2FA

After 2FA is enabled, `POST /api/auth/login` returns a challenge instead of a full session. Verify the code to complete sign-in:

```bash theme={null}
curl -X POST https://ariacompute.com/api/auth/2fa/verify \
  -H "Content-Type: application/json" \
  -d '{"challenge": "chg_01H...", "code": "123456"}'
```

The successful response has the same shape as a normal login: a `token` plus a `user` object.

## Disable 2FA

```bash theme={null}
curl -X POST https://ariacompute.com/api/auth/2fa/disable \
  -H "Authorization: Bearer eyJhbGciOi..." \
  -H "Content-Type: application/json" \
  -d '{"code": "123456"}'
```

<Warning>
  Disabling 2FA weakens account security. Only do so when you plan to re-enroll on a new device immediately after.
</Warning>

## Manage active sessions

Every sign-in creates a session. Review and revoke them:

<CodeGroup>
  ```bash List sessions theme={null}
  curl -H "Authorization: Bearer eyJhbGciOi..." \
    https://ariacompute.com/api/auth/sessions
  ```

  ```bash Revoke one session theme={null}
  curl -X DELETE \
    -H "Authorization: Bearer eyJhbGciOi..." \
    https://ariacompute.com/api/auth/sessions/sess_01H...
  ```

  ```bash Revoke everything except this one theme={null}
  curl -X POST \
    -H "Authorization: Bearer eyJhbGciOi..." \
    https://ariacompute.com/api/auth/sessions/revoke-others
  ```

  ```bash Log out this session theme={null}
  curl -X POST \
    -H "Authorization: Bearer eyJhbGciOi..." \
    https://ariacompute.com/api/auth/logout
  ```
</CodeGroup>

<Tip>
  If you suspect a device was compromised, revoke other sessions first, then rotate any `bfvk-` API keys that may have been visible on that device.
</Tip>


## Related topics

- [Aria Compute Documentation](/index.md)
- [POST /api/auth/login — sign in with email or phone](/api-reference/auth/login.md)
- [GET /api/payments/providers — enabled payment channels](/api-reference/site/payment-providers.md)
- [Aria Compute REST API reference](/api-reference/introduction.md)
- [International and China sites, and how to choose](/concepts/sites-regions.md)