Cloudflare Two-Factor Authentication: Setup and Recovery

Turn on Cloudflare 2FA in My Profile › Authentication. Add an authenticator app or a security key, and save the backup codes somewhere safe.

Set it up

1. Sign in to the Cloudflare dashboard.
2. Open My Profile › Authentication.
3. Under two-factor authentication, add a method.
4. Scan the QR code with an authenticator app, or register a security key.
5. Save the backup codes.

Methods

Requiring 2FA for your team

Account owners can require members to use two-factor authentication. Members without it are asked to set it up before they can access the account. This protects DNS and security settings for the whole team.

Lost your device

• Sign in with a backup code.
• Then remove the old method and add a new one.
• Without backup codes, follow Cloudflare's account recovery process; it can take time to verify ownership.

Why it matters

A Cloudflare account controls a website's DNS. Someone with access could point the domain elsewhere, read traffic settings or turn off protections. Two-factor authentication is one of the most important settings for anyone running a site.

API tokens

Scripts and tools should use API tokens with limited permissions, not your login. Tokens are not affected by 2FA, so keep them secret and rotate them if leaked.

Single sign-on

Teams using single sign-on through their identity provider manage two-factor there.

New to authenticators? See authenticator apps explained and passkeys.

Email security

Your Cloudflare login email can reset the password. Protect that email with its own two-factor authentication, ideally an authenticator app or security key, or an attacker could start from there.

Audit logs

Cloudflare keeps audit logs of account changes. Review them after any security scare to see what was changed and by whom.

Store backup codes offline

Print the backup codes or keep them in a password manager that is not protected only by the same Cloudflare account. Teams should make sure at least two people can access the account, each with their own login and two-factor method.

Security keys

Cloudflare accepts hardware security keys alongside authenticator apps. A key is resistant to phishing pages, since it only works on the real Cloudflare login, which makes it a strong choice for accounts that control websites.

FAQ

How do I turn on Cloudflare 2FA?

My Profile › Authentication › two-factor authentication.

Can I require 2FA for my Cloudflare team?

Yes, account owners can require it.

What if I lose my Cloudflare 2FA device?

Use a backup code.

Related: authenticator apps · passkeys · GitHub 2FA.