Skip to content
Security

Use Google Authenticator to protect a merchant account

Set up authenticator protection, store recovery codes safely and distinguish Google Authenticator from Google sign-in.

THE SHORT ANSWER

Google Authenticator can provide an additional time-based sign-in code for a Coinvay account. This is separate from Sign in with Google: one generates verification codes, while the other authenticates through a connected identity provider.

Enroll and confirm the intended account

Open the account Security page while signed in and follow the authenticator setup flow. Scan the enrollment QR or enter the secret privately in your authenticator app, then confirm a current code to finish enabling protection. Check the account name so your merchant and administrator entries are not confused. Do not send the enrollment secret, QR screenshot or recovery codes to a developer or support chat.

Prepare for device loss

For example, a sole merchant operator should store the supplied recovery codes in a protected place separate from the everyday phone. Test the recovery procedure without publishing or sharing the codes. If authenticator codes fail, check that the device’s clock is correct and use the appropriate account entry; repeatedly trying a code from another site will not help. Recovery material is sensitive because it exists to regain account access.

Understand what the extra code protects

The additional factor protects supported account authentication and sensitive workflows; it does not sign blockchain transfers or make a compromised wallet safe. Keep the account password unique, protect the email inbox and review connected login providers as well. A phishing site can still ask for a current code, so verify the domain before entering it. If your sign-in setup uses an external provider or has not completed email enrollment, follow the exact account setup shown rather than assuming every login method has identical recovery behavior.

Practical checklist

  • Enroll the correct merchant or administrator account and confirm setup successfully.
  • Store recovery codes securely and keep device time synchronized.
  • Verify the Coinvay domain before entering passwords, codes or recovery information.

Common questions

Is Google Authenticator the same as Google sign-in?+

No. Authenticator generates a second-factor code. Google sign-in is an OAuth identity-provider option configured separately.

Should I give support my current authenticator code?+

No. Enter codes only in the legitimate sign-in or account-confirmation flow you initiated. Do not share secrets or recovery codes in messages.

Sources and further reading

Primary references and Coinvay product documentation. Check the linked pages for current details.

  1. Coinvay merchant API documentation
  2. Google Authenticator help
  3. TOTP protocol specification

AI-assisted drafting, published by Coinvay. Examples are illustrative. Read our editorial approach.

Back to all articles