GitHub shows this notice when an account is asked to enroll in two-factor authentication. The sentences are GitHub's. The enroll link only works after you sign in.

Click here to enroll in 2FA.

Making the software supply chain more secure is a team effort, and we can't do it without you. Your enrollment in 2FA is an impactful step in keeping the world's software secure. If you want to learn more about this change, please take a look at our documentation about the program.

To see this and other security events for your account, visit your account security audit log.

What the program requires

GitHub's documentation says that, as of March 2023, accounts that contribute code on GitHub.com can be required to turn on 2FA. Eligible actions include publishing an app or Action, creating a release, contributing to high-importance repositories, administering those repositories, owning an organization, publishing a package, or administering an enterprise. If you were not notified, GitHub says you were not in a required group. The criteria can change. The page is About mandatory two-factor authentication.

The notice starts a 45-day enrollment period, then a 7-day grace period. When both have passed, GitHub.com stays closed until 2FA is on. Personal access tokens and OAuth tokens already issued keep working. A locked account cannot authorize a new app or create a new personal access token until 2FA is on. GitHub recommends a time-based authenticator app as the primary method, and a passkey or security key as backup. SMS is the method GitHub tells you not to prefer. An authenticator app does not require giving GitHub a phone number. GitHub Enterprise Managed Users and GitHub Enterprise Server are outside this program.

What this changes for a shop you deploy

FatLeon Commerce runs in an AWS account you control. A GitHub login is not part of that deploy. Amplify Hosting and the shop stay up if GitHub locks the browser session. What GitHub holds is the private git, if that is where you keep the source. The license allows a private git. It does not allow a public repository that exposes the source to people who are not licensed. See Terms of Service and what you run on AWS Amplify.

Bind Google Authenticator

GitHub accepts any app that speaks TOTP, the time-based one-time password in RFC 6238. Google Authenticator is one of them. The steps follow GitHub's configuration guide. The drawings are ours. They are not screenshots, and the QR pattern is not a secret. Scan only the code GitHub shows on your own screen. Do not send that code, or the setup key, in chat or email.

Profile photo, Settings, Password and authentication, then Enable two-factor authentication. The enroll link opens the same flow.

1. Install Google Authenticator from the App Store or Google Play. Open it once so the camera permission can be granted.
2. On GitHub, while signed in, open the enroll page. Or click your profile photo, then Settings. In the Access section of the sidebar, click Password and authentication. Under Two-factor authentication, click Enable two-factor authentication.
3. When GitHub shows a QR code, stay on that method.

In Google Authenticator, tap +, then Scan a QR code. The new row is GitHub. The six digits change about every 30 seconds. 482193 in the drawing is a sample.

1. In Google Authenticator, tap +, then Scan a QR code, and point the camera at the QR code on the GitHub page. If the camera cannot read it, click setup key on GitHub. In the app, choose Enter a setup key. Name the account GitHub, leave the type as time based, and paste the secret.
2. The app shows a six-digit code. On GitHub, type it under Verify the code from the app before the code refreshes. If it is rejected, wait for the next code. Set the phone's clock to automatic.

Enter the current code, download the recovery codes, then confirm that you saved them. That confirmation is what turns 2FA on.

1. Under Save your recovery codes, download the codes and put them somewhere that is not the phone and not the GitHub account. Then click I have saved my recovery codes. GitHub's guide says that click enables 2FA.
2. GitHub then starts a 28-day check-up. Sign in with the app once during those 28 days. A passkey or a security key can be added afterwards. GitHub's guide says those are backups, and a TOTP app or SMS has to be configured first.

Sign-ins and other security events are on the account security log. If the phone is lost, start from GitHub's own page, Recovering your account if you lose your 2FA credentials.