<!-- LLM_VERSION_INFO
FORMAT: text/markdown
CONTENT_TYPE: article
ORIGINAL_URL: https://www.carbon.money/docs-sub/docs/2fa
ALTERNATE_VERSION: docs-sub/docs/2fa/index.html (text/html)
EXTRACTION_DATE: 2026-06-11T01:43:35.148Z

This is the markdown version with text-only content (images converted to alt-text).
For rich formatting with images, request the HTML version at: docs-sub/docs/2fa/index.html
-->

## Google 2FA Overview

Google 2FA is required once a user passes KYC.

We believe Google 2FA is very important because it prevents unauthorized access to your accounts. Google 2FA is also more secure than SMS-2FA because of recent sim-swapping hacks. Sim-swapping can reset your iCloud, your email and [all of your cryptocurrency accounts](https://www.ccn.com/teen-hackers-pinch-35-million-in-california-sim-scam-crypto/).

2FA can also be enabled at any time to protect a user's account. The steps to enabling 2FA are as follows:

1. **Create a 2FA**  
   Once the user has linked the 2FA with his/her Google Authentication ([iOS](https://itunes.apple.com/us/app/google-authenticator/id388497605?mt=8) or [Android](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en_US)), they need to send in the real time 6-digit token to step 2.

2. **Enable 2FA**  
   If the token checks true, 2FA has successfully been added.

3. **Disable 2FA (optional)**  
   A user may also disable 2FA if they pass in their token. Remember, all KYC-ed users are required to have 2FA for account safety purposes.

### 1: Create 2FA

GET

### Request Parameters

| Parameters        | Access   | Description                                                                                                                                                 |
|-------------------|----------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|
| twoFactorIssuer   | optional | When you create a google 2FA, your users will see a name corresponding to the 6 digit code. The `default` value is `Carbon2FA` but you can set this to something more relevant |
| contactId        | required |                                                                                                                                                              |

### JavaScript
```javascript
let secretKey = 'sk_test_A41Hm6IY3Q5LJ7ham34Zpkcj';

let headers = {
  headers: {
    Authorization: `Bearer ${secretKey}`
  }
};

let url = `${ROOT}/v1/auth/create2fa?contactId=ab5bb41b-5979-4a54-b734-23eb9076188e&twoFactorIssuer=CompanyName`;

axios.get(url, headers).then(result => console.log(result)).catch(err => console.log(err));
```

### Success and Error Responses

```json
{
  "message":"Successfully created 2fa!",
   "code": 200,
  "details":{
    "qrCode":"data:image/png;base64,...",
    "manual":"KA7F4SJTKYSUSL2RHZXSGUCMKVDSK6RYJFTSQMBVONGVONKCJIUA"
  }
}
```

```json
{
  'message': 'You must disable 2fa before you can create a new 2fa.',
  'code': 403
}
```

```json
{
  'message': 'You cannot enable 2fa again as it is already set.',
  'code': 409
}
```

```json
{
  'message': 'Error enabling 2fa.',
  'code': 500
}
```

### Response Parameters

| Response | Description |
| --- | --- |
| qrCode | If you add this as the source for a  tag on the front end, you can generate a qrCode users can scan. |
| manual | Your users can also add this auth using a manual entry for Google 2FA. |

## 2: Enable 2FA

POST

### JavaScript
```javascript
let secretKey = 'sk_test_A41Hm6IY3Q5LJ7ham34Zpkcj';

let headers = {
  headers: {
    Authorization: `Bearer ${secretKey}`
  }
};
let url = `${ROOT}/v1/auth/enable2fa`;

let data = {
  token: '1234565',
  contactId: 'ab5bb41b-5979-4a54-b734-23eb9076188e'
}

axios.post(url, data, headers).then(result => console.log(result)).catch(err => console.log(err));
```

### Success and Error Responses

```json
{
  'message': 'Successfully enabled 2fa!',
  "code": 200
}
```

```json
{
  'message': 'Google 2FA requires token to be passed in.',
  'code': 401
}
```

```json
{
  'message': 'Google 2FA failed.',
  'code': 401
}
```

```json
{
  'message': 'Error enabling 2fa.',
  'code': 500
}
```

## 3: Disable 2FA

POST

### JavaScript
```javascript
let secretKey = 'sk_test_A41Hm6IY3Q5LJ7ham34Zpkcj';

let headers = {
  headers: {
    Authorization: `Bearer ${secretKey}`
  }
};

let url = `${ROOT}/v1/auth/disable2fa`;

let data = {
  token: '1234565',
  contactId: 'ab5bb41b-5979-4a54-b734-23eb9076188e'
}

axios.post(url, data, headers).then(result => console.log(result)).catch(err => console.log(err));
```

### Success and Error Responses

```json
{
  "message": "Successfully disabled 2fa!",
  "code": 200
}
```

```json
{
  "message":  "Google 2fa requires token to be passed in.",
  "code": 401
}
```

```json
{
  "message": "Google 2fa failed.",
  "code": 401
}
```

```json
{
  "message": "Error disabling 2fa.",
  "code": 500
}
```

## 4: Delete 2FA

POST

### JavaScript
```javascript
let secretKey = 'sk_test_A41Hm6IY3Q5LJ7ham34Zpkcj';

let headers = {
  headers: {
    Authorization: `Bearer ${secretKey}`
  }
};

let url = `${ROOT}/v1/auth/delete2fa`;

let data = {
  contactId: 'ab5bb41b-5979-4a54-b734-23eb9076188e'
}

axios.post(url, data, headers).then(result => console.log(result)).catch(err => console.log(err));
```

### Success Response

```json
{
  "message": "Successfully deleted 2fa!",
  "code": 200
}
```

## 5: Get Current 2FA Status

GET

### JavaScript
```javascript
let secretKey = 'sk_test_A41Hm6IY3Q5LJ7ham34Zpkcj';

let headers = {
  headers: {
    Authorization: `Bearer ${secretKey}`
  }
};

let url = `${ROOT}/v1/auth/2fa?contactId=ab5bb41b-5979-4a54-b734-23eb9076188e`;

axios.get(url, headers).then(result => console.log(result)).catch(err => console.log(err));
```

### Success Responses

```json
{
  "message": "2FA is true.",
   "code": 200,
  "status": true
}
```

```json
{
  "message": "2FA is false.",
   "code": 200,
  "status": false
}
```

```json
{
  "message": 'Error getting 2fa.',
  "code": 500
}
```