How to enable Google Authenticator TOTP two-factor authentication to protect your BabyShopHub account.

Account Security & 2FA

BabyShopHub supports Time-based One-Time Password (TOTP) two-factor authentication, compatible with Google Authenticator, Authy, and any RFC 6238-compliant TOTP app.

Why Enable 2FA?

With 2FA enabled, logging into your account requires both:

Your email and password (something you know)
A 6-digit code from your authenticator app (something you have)

Even if someone learns your password, they cannot access your account without your phone.

Setting Up Google Authenticator 2FA

Prerequisites

Download Google Authenticator, Authy, or any TOTP-compatible app on your phone

Steps

Go to Profile Screen → "Security Settings" or "Two-Factor Authentication"
Tap "Enable Authenticator App"
BabyShopHub generates a unique TOTP secret key
A QR code is displayed — open your authenticator app and scan it
- Or manually enter the 16-character secret key shown below the QR code
Your authenticator app will immediately begin showing 6-digit codes that refresh every 30 seconds
Enter the current 6-digit code from your app into the verification field
Tap "Activate 2FA"

If the code is correct, 2FA is activated. Your secret is saved encrypted in Firestore (totpSecret field) and in SharedPreferences.

Logging In With 2FA Active

After entering your email and password on the Login Screen:

BabyShopHub verifies your credentials with Firebase Auth
Since 2FA is enabled, you are temporarily signed out
A second screen appears asking for your authenticator code
Open your app and enter the current 6-digit code
Tap "Verify" — you are signed in

TOTP codes are valid for 30 seconds. BabyShopHub also accepts codes from the previous and next 30-second windows to account for minor clock drift between your device and the server.

Disabling 2FA

Go to Profile → Security Settings
Tap "Disable Authenticator App"
Confirm the action

Your totpSecret is cleared from both Firestore and SharedPreferences. Future logins will no longer require the authenticator code.

If you lose access to your authenticator app and 2FA is enabled, you will not be able to log in. Contact support immediately for account recovery assistance.

Every time you successfully log in with email/password, BabyShopHub sends a security alert email to notify you:

Subject: ️ Security Alert: Login Notification
Content: The exact time of the login

This helps you detect unauthorized access immediately. If you receive this email without logging in yourself, change your password immediately.

Security Best Practices

Use a strong, unique password for BabyShopHub
Enable 2FA with Google Authenticator
Never share your OTP codes or authenticator QR with anyone
Review login notification emails regularly
Sign out when using the app on shared devices

Account Security & 2FA

On this page