Account security
Two-factor sign-in, passkeys, recovery codes and where you're signed in.
Your account's security settings have two parts: Two-factor sign-in, a second step after you sign in, and Where you're signed in, every device that is signed in to your account. To open them, choose Security in your account menu, or go to guild.xyz/account#security.
Two-factor sign-in
Two-factor sign-in adds a second step, so a stolen wallet or inbox isn't enough to get into your account. You can use either way, or both:
- Authenticator app: a 6-digit code from an app such as 1Password or Google Authenticator.
- Passkeys: your fingerprint, face or screen lock instead of a code. Your browser needs to support passkeys; if it doesn't, the Add button stays off.
Once one is on, every new sign-in asks for it, whichever way you sign in: wallet, email or a social account. Connecting another account while you're already signed in doesn't ask for it.
Set up an authenticator app
- Under Two-factor sign-in, press Set up next to Authenticator app.
- Open an authenticator app on your phone and scan the QR code, or type the key shown under it.
- Enter the 6-digit code the app shows.
Add a passkey
- Press Add next to Passkeys.
- Give the passkey a name, then press Create passkey and follow your browser's prompt.
You can add more than one passkey, for example one per device. Each one shows when it was added and last used, and Synced when your password manager keeps it on your other devices. Rename or remove a passkey from its row.
Recovery codes
When you turn on your first way to sign in, Guild gives you ten recovery codes. Each code lets you in once if you lose your phone or passkey. They are shown only once: copy or download them, keep them somewhere safe, and tick that you saved them to close the window.
The Recovery codes row shows how many are left and warns you when three or fewer remain. Press New codes to make a fresh set; your old codes stop working.
Confirm it's you
Changing two-factor asks you to confirm with a way you already have: a code from your app, a passkey or a recovery code. It asks before you remove the authenticator app or a passkey, make new recovery codes, or add another way in.
Turning on two-factor for the first time needs a recent sign-in instead. If you signed in more than 15 minutes ago, Guild asks you to Sign in again first.
If you remove your last authenticator app or passkey, two-factor is off and your recovery codes are deleted.
Deleting your account or disconnecting a sign-in method
Deleting your account and disconnecting a connected account (a wallet, email or social account) ask you to confirm it's you first. If you signed in in the last 15 minutes, nothing extra is asked. Otherwise Guild asks for a code from your app, a passkey or a recovery code if you have two-factor, or asks you to sign in again if you don't.
Signing in with two-factor
After your wallet, email or social account, Guild asks for your second step. Enter the code from your authenticator app, press Use passkey, or switch to Use a recovery code. You have 10 minutes to finish; after that, start the sign-in again.
After too many wrong codes, Guild asks you to wait a few minutes before you try again.
If you can't use your app or passkey, press Can't use any of these? It explains the recovery code option and has a button that opens a message to Guild support on Telegram with your account id filled in. It doesn't skip the second step: support checks it's you first (see below).
Where you're signed in
Where you're signed in lists every device that is signed in to your account. Each row shows:
- the browser and system, for example "Chrome on macOS", and This device for the one you're using
- roughly where it is and its IP address
- how it signed in, and the second step it used, if any
- when it signed in and when it was last active
Press Sign out on a row to sign that device out. Sign out others signs out every device except this one. A device you sign out has to sign in again, second step included.
A sign-in lasts at most 30 days, however often you use it. Then you sign in again.
Security e-mails
Guild e-mails you when something changes in your account's security:
- you add or remove an authenticator app or a passkey
- you make new recovery codes
- Guild support resets your two-factor
- you connect or disconnect a sign-in method (a wallet, email or social account)
- you delete your account
- someone signs in from a device Guild hasn't seen on your account before
A new device means a browser, system and country you haven't signed in from before. You get at most one e-mail a day for the same device. The e-mail says what happened, when, on which device and roughly where. It never contains a code.
Security e-mails go to the email address you connected to your account, or to your Google account if you have no email connected. Connect one under Connected accounts to get them; without one, Guild has nowhere to send them. Security has a reminder when you have none.
For a disconnect or a deletion, the e-mail goes to the address your account had just before the change, so it still reaches you if you disconnect that email. The deletion e-mail comes after the account is deleted, and tells you to contact support if it wasn't you.
If you get one for something you didn't do, open your account, sign out the sessions you don't recognise and check your sign-in methods.
If you're locked out
If you've lost your authenticator app and passkeys, sign in with one of your recovery codes, then set up two-factor again.
If you have no recovery codes left either, contact Guild support (the sign-in screen's Can't use any of these? opens that message for you): message @Zawiasa on Telegram, or reply to any security e-mail from Guild. Support checks that you own the account in a way that doesn't rely on your e-mail, then resets your two-factor. The reset removes your authenticator app, passkeys and recovery codes and signs you out everywhere, and Guild e-mails you that it happened. You can then sign in without the second step and set it up again.