How to use Google or Microsoft Authenticator for your store, step by step

Before you start: what will I need?

Two-step verification, or 2FA, means entering one more code after your usual sign-in. Your Authenticator app makes this six-digit code. It is different from your password and is not an SMS message. You do not need to memorize it: open the app when the website asks for it.

Keep your phone and the website ready. A computer and phone make scanning easy, but you can also do everything on one phone. You need access to the account and its current password before starting setup.

For a customer account, open My account or Account security on your store website. For the account used to rent and manage stores, open Account security in the central SellyHub dashboard. These settings are separate, even when both accounts use the same email address.

• Authenticator app: the app on your phone that displays codes.
• Setup key: the private text used to add your account to the app. It is not your six-digit code.
• Recovery code: an emergency code to keep separately in case you cannot open the app.

1. Install one Authenticator app

Choose either Google Authenticator or Microsoft Authenticator. You do not need both. Use the matching official app below and check the publisher before tapping Install. When installation finishes, tap Open.

Choose Google Play for Android or App Store for iPhone / iPad. Each button opens that app’s download page directly. Do not enter your store password on the app download page.

Google Authenticator

Google LLC

Google Play · Android ↗ App Store · iPhone / iPad ↗ Read this app’s steps ↓

Microsoft Authenticator

Microsoft Corporation

Google Play · Android ↗ App Store · iPhone / iPad ↗ Read this app’s steps ↓

2. Start setup on your store or SellyHub website

This part takes place in your web browser, not in the Authenticator app. Check the website address, then open the security settings for the account you want to protect.

The website shows a QR code and a manual setup-key option. A QR is a square pattern the app can scan. Both methods add the same account. Keep this setup dialog open while you follow the instructions for your chosen app below.

1. Enter the current password for this account.
2. Complete the security check displayed on the page. If it fails, retry the check before submitting.
3. Choose Start 2FA setup. Wait for the setup dialog to open.

Setup has not enabled 2FA yet. The pending setup lasts ten minutes; if it expires, start again. Keep its QR and setup key private.

3A. If you chose Google Authenticator

The pictures below are real screenshots published by Google on Google Play. The example account names and numbers belong to those promotional screenshots. Your own app will show the account you add.

Get started means begin. Scan a QR code means use the camera to read the square pattern on your website. Enter a setup key means type or paste the private text shown by your website.

1. Open Google Authenticator. If you see an introduction, tap Get started. When offered account sync, you can choose your Google account or Use without an account. A Google account is not required just to generate codes for your store.
2. Find the multicolored + button. In the pictured version it is at the bottom right. Tap it to add an account.
3. If your website is on a computer or another device, choose Scan a QR code, allow camera access, and point the camera at the QR in your website setup dialog. You do not need to take or send a photo.
4. If you cannot scan, choose Enter a setup key. In the account-name field use a name you recognize, such as My game store — my account. Paste the key copied from the website into the key field. Select Time based, then tap Add.
5. Return to the app’s account list. Find the entry for this store. A changing six-digit number should appear beneath it. Keep the entry: you will use it again every time the website asks for a code.

You are adding your store account to the app. You do not have to open Google Account security settings or enable 2FA on your Google account to complete this store setup.

Tap a picture to open the full-size image. App labels can vary by version.

3B. If you chose Microsoft Authenticator

The picture below is an actual promotional screenshot from Microsoft’s Google Play listing. It shows several example accounts in one app. Your store account will have its own entry and code.

For a SellyHub store, use Other account. You are adding a website account, not setting up a Microsoft work or school account. Other account means a service outside those Microsoft account types.

1. Open Microsoft Authenticator and complete any introductory or privacy screens shown by the app. The screens can vary by app version.
2. Tap the + button or Add account at the top. If your version places Add account inside the menu, open that menu first.
3. Select Other account, sometimes labeled Other (Google, Facebook, etc.).
4. Allow the camera when asked and scan the QR displayed in your website setup dialog. If scanning is unavailable, use the app’s manual-entry option and copy the account name and private setup key from your own website.
5. Check the account list. Open or select the entry for your store to find its changing six-digit verification code, then return to the website to finish setup.

Microsoft also advertises push approvals, passwordless sign-in and work accounts in its screenshots. For this store setup, use the six-digit code. You do not need an Approve sign-in notification.

Tap a picture to open the full-size image. App labels can vary by version.

Using just one phone? Switch between the website and app

A phone cannot point its camera at a QR displayed on that same phone. Use the Open in app option when the website provides it, or add the account by entering the setup key. You do not need a second phone.

1. In the website setup dialog, expand the manual-key option and copy the setup key.
2. Switch to your Authenticator app, add the account manually, and paste the key. For Google Authenticator, select Time based.
3. Switch back to the browser and the same setup dialog. Keep the browser tab open; if setup expires, begin a new setup instead of using the expired key.
4. After you have added the account, use the six-digit app code in the next step.

4. Enter the six-digit code on the website

The code may look like two groups of three numbers. Enter all six numbers in order, including any zero at the beginning. Use the code from your own account entry; numbers shown in the screenshots in this guide will not work.

The countdown or small clock shows when the code will change. If it is almost finished, wait for the next code so you have time to type. An incorrect code does not complete setup.

1. In the app, check that you selected the correct store account.
2. Read its current six-digit code, then return to your website setup dialog.
3. Enter the code and choose the button to confirm activation.
4. Wait until the website says 2FA is enabled. Installing the app or scanning the QR alone does not enable it.

5. Save the recovery codes before leaving

After activation, the website shows ten recovery codes once. These are emergency codes for times when your phone is missing or the app is unavailable. Each code works only once.

Save them in a password manager or another private place you can still access without that phone. Label them with the correct store or account name. Do not post them in chat, a shared photo album or a support message. If a trusted adult is helping you, ask them to help you store the codes privately.

Creating a replacement set makes the previous set unusable. Keep the new set when you replace it. Recovery codes and app codes are different: use the matching option on the website.

6. What to do the next time you sign in

You do not scan a new QR every time. Keep the account entry you already added to your Authenticator app.

1. Sign in to the website using your usual email and password, or a provider already linked to your account.
2. When the verification dialog appears, open the app and find the matching account.
3. Return to the website, enter its current six-digit code and confirm.
4. If you cannot use the app, switch to the recovery-code option and use one unused recovery code.

If it does not work, check these things first

If a code is rejected, check the account name, wait for a fresh code and enable automatic date and time in your phone settings. A code that was already accepted cannot be reused. Google Authenticator uses the phone’s system time; do not look for an old time-correction menu inside the app.

If the website session expired, sign in again. If the pending setup expired, begin a new setup with your password. If camera access was denied, allow it in your phone settings or use manual entry.

Before changing phones, follow your app provider’s transfer or backup instructions and verify that the new phone’s codes work before removing the old entry. Keep recovery codes available. If you have neither the app nor recovery codes, contact the store or platform that manages the account. Do not send anyone your password, setup key, QR or recovery codes.