Skip to content
HamstikHamstik Docs

Account security and two-factor authentication

Account security and two-factor authentication

Two-factor authentication (2FA) adds a rotating 6-digit code from an authenticator app to your Hamstik password or OAuth sign-in. It is available on every plan and is managed per account at Account → Account security.

Hamstik uses the interoperable time-based one-time password (TOTP) profile from RFC 6238: 6 digits, a 30-second step, and HMAC-SHA-1. It works with common authenticator apps.

Enable two-factor authentication

  1. Open Account → Account security.
  2. Choose Set up two-factor authentication.
  3. Scan the QR code with your authenticator app, or enter the setup key manually. The key is different for every account and is shown only during setup.
  4. Enter the 6-digit code the app shows.

For your protection, Hamstik only starts enrollment when you authenticated recently or confirmed your current password. A pending enrollment expires after 10 minutes and does nothing until a valid code confirms it. Starting over replaces the previous pending key.

The setup key is never displayed again after enrollment, and it is encrypted at rest. Hamstik never logs codes, setup keys, or QR data.

Save your recovery codes

When enrollment is confirmed, Hamstik shows 10 recovery codes. Each is a one-time code with at least 128 bits of entropy.

  • Download or copy the set and store it somewhere safe and offline.
  • The set is shown only once. Hamstik stores only irreversible hashes.
  • Each code works exactly once.

To replace the set, choose Regenerate recovery codes and prove your identity with your current authenticator code or an unused recovery code. Regeneration immediately invalidates every older code.

Sign in with 2FA

After your password, GitHub, or Google sign-in succeeds, Hamstik asks for your authenticator code. Complete the challenge within 5 minutes. You can enter a recovery code instead if you cannot use your app.

  • A new challenge does not reset the failure counter.
  • After 5 failed code attempts for your account in a rolling 10-minute window, further attempts are rejected with 429 and a Retry-After header until the window allows another try. This is a temporary delay, not a permanent lock.
  • Until the challenge is completed, the sign-in is restricted and cannot open the application, change account settings, or create credentials.

Disable two-factor authentication

Choose Disable two-factor authentication and provide a current authenticator code or an unused recovery code. You must also have authenticated recently or confirm your current password.

Disabling, and enabling, revokes your other interactive browser sessions. The session you are using is rotated and stays signed in. Password reset, changing your email address, and linking an OAuth provider never silently disable 2FA.

Personal Access Tokens and automation

Personal Access Tokens (PATs) remain noninteractive and are not affected by signing out of browser sessions. When 2FA is enabled, creating a new PAT requires that you recently completed MFA; existing PATs are never deleted just because you enabled 2FA. See Personal Access Tokens for the full credential model.

Registered accounts and your password

Accounts created through email and password registration exist only after the emailed verification link confirms the address, so a password is never attached to an unverified address. The password you choose is stored only as an Argon2 hash; verification links are single-use, expire after 30 minutes, and only their digest is persisted. All the protections below — 2FA, password change, password reset, and Sign out everywhere — apply to registered accounts exactly as they do to accounts created through GitHub, Google, an invitation, or Organization SSO.

If you lose both factors

If you still have a recovery code, use it to sign in and then regenerate a new set. If you have lost your authenticator and every recovery code, Hamstik does not offer an email-only self-service reset, and an Organization administrator cannot reset the 2FA on a global Hamstik account. Use the verified account-recovery process through support, which confirms account ownership before any factor is reset. Every such reset is audited.

Notifications and audit

Hamstik sends a security notification when 2FA is enabled or disabled, when recovery codes are regenerated, when a recovery code is used, and when a challenge fails. Notifications never contain a code, secret, or setup URI. Account configuration changes and recovery-code use are recorded in the account audit trail with redacted outcomes.