Two-factor authentication is here for Nameshift seller accounts. After your password, the dashboard asks for a six-digit code from an authenticator app or a passkey before anyone reaches your domains. Turn it on from the Security page under Settings; it takes a few minutes.
What one password guards
Your Nameshift account is where your domains are listed and where their prices are set. Until you add the second step, a password is all that is needed to reach any of it, and passwords tend to leak, get reused elsewhere or get typed into a copy of a login page.
Investors on other marketplaces have said this for years: whoever gets into a seller account can drop the price of a good name and buy it before the owner notices. The UK's NCSC guidance for domain registrars puts the baseline plainly: "Enabling MFA should be the default for all users". The second step is now in your dashboard, and turning it on takes a few minutes.
Authenticator app, passkey or both
An account signs in one of four ways: a password alone, a password followed by a second step, a passkey followed by an authenticator-app code, or a passkey alone. You pick the method on the Security page under Settings; methods you have not set up yet show as locked, with what to do to unlock them.
The authenticator app is the standard six-digit code that changes every thirty seconds: Google Authenticator, Authy and 1Password all work, and the entry appears in the app under the name Nameshift. A code from the previous or next thirty-second window is still accepted, and no code is accepted twice.
A passkey is the fingerprint, face or PIN you already use to unlock your device. Because a passkey proves it is you on its own, it can be the whole sign-in: a "sign in with a passkey" button on the login page, with no email or password typed. You can add several and give each a name.
Recovery codes are the fallback for a lost phone. Once you have an app or a passkey, you can turn on ten single-use codes, shown once with copy and download buttons, so save them right then. The Security page shows how many are left, and you can generate a fresh set.
How you turn it on
- Open Settings > Security and start the authenticator app setup. The page first asks you to confirm it is you with your password, and that confirmation lasts ten minutes until you reload.
- Scan the QR code under Authenticator app with your app, or copy the secret (shown in groups of four) and type it in by hand.
- Type the six-digit code the app now shows. The app is switched on once that code is accepted, and your sign-in method moves to password plus a second step by itself.
- Add a passkey if your device offers one, then turn on recovery codes and download them before you close the page.
After that, the login page offers the method you used last time first, and the step has to be done within five minutes of the password. Five wrong codes lock the second step for fifteen minutes; passkey attempts never count toward that lock.
Changes that weaken the account ask for proof again: switching the app off needs a code from that app, removing a passkey needs that passkey one last time, and moving to a weaker sign-in method asks you to confirm first.
Sign-ins from a new network
Separate from the second step, and on for every account, is new-location verification: a sign-in from a network operator we have never seen you on waits until you approve it from an email. The email lists the IP address, network, country, browser and time of the attempt, and its link is valid for fifteen minutes; the first network we see you on is trusted without asking.
Approving the email releases the sign-in only to the browser that started it, never to whoever clicked the link; that browser checks every three seconds, so there is nothing to refresh. "No, it is not me" points you to changing your password.
The check can be turned off on the Security page after confirming it is you, and the same page keeps a log of your last twenty sign-in attempts, successful or not, with the method, network, country, IP address and browser of each.
Set it up today
Two-factor authentication is free and optional, and the recovery codes are your way back in after a lost phone, so keep them somewhere other than the phone that holds the app.
Pick the authenticator app you want to use, or check whether your browser offers passkeys, then open Settings > Security in your seller dashboard. If you are not selling on Nameshift yet, the sellers page explains how listing works.
