Sign-In Security

To keep your AppSumo account safe we've got an extra sign-in check. When you sign in from a browser we haven't seen before, we email a 6-digit sign-in code to your login email to confirm it's you. It takes a few seconds and only happens on new browsers.

You can also add an authenticator app for stronger protection, and you'll now get an email whenever your email or password changes. This article explains what you'll see and how to handle the most common situations.

Signing in from a new browser

When you log in from a browser or device we haven't seen before, we email a 6-digit code to your login email. Type it on the sign-in page and you're in.

A few things to know:

The code works for 10 minutes, and only the newest one works. If you requested a few, use the latest.
You can ask for a new code once a minute, up to 5 times an hour. If you hit the limit, the page shows when you can try again.
If you don't see it, check your Spam and Promotions folders for an email from AppSumo with the code in the subject line.

If you sign in with Google, you can use "Log in with Google" instead of waiting for a code.

Remember this browser

You don't have to enter a code every time! On the code page, leave "Remember this browser" ticked and we won't ask again on that browser for 30 days.

A few things reset it, and after any of these each browser will ask for a code once more:

Changing your password
Changing your login email
Signing out everywhere

You can see and remove remembered browsers anytime in your Profile settings, under Sign-in & security.

Setting up an authenticator app

An authenticator app is the strongest way to protect your account. Once it's set up, you'll use the app's code to sign in instead of an emailed code. Here's how to add one:

Go to Profile settings and open Sign-in & security.
Choose "Set up" next to Authenticator app. We'll ask you to confirm it's you first.
Scan the QR code with an app like Google Authenticator, 1Password, or Authy, then type the 6-digit code it shows.
Save the 10 recovery codes we show you. We only show them once, so keep them somewhere safe — they're how you get back in if you lose your phone.

If you recently changed your login email, authenticator setup opens 7 days after that change.

Passkeys and security keys

A passkey lets you sign in with the fingerprint, face, or screen lock you already use on your phone or laptop — there’s nothing to type, and it only works on the real appsumo.com, so a fake login page can’t use it. Your fingerprint and face never leave your device; AppSumo never sees them. You can also use a security key like a YubiKey.

To add one:

Go to Profile settings → Sign-in & security and click “Add a passkey” (we’ll ask you to confirm it’s you first).
Have a YubiKey or similar? Use “Add a security key” right below it.

You can keep as many as you need — up to 20 passkeys, security keys, and authenticator apps on one account — each with a name and the date you last used it, so you can rename or remove any of them anytime.

If you lose your phone or key: sign in with anything else on your account — another passkey, a security key, your authenticator app, or one of your recovery codes — then remove the lost one in Sign-in & security.

Recovery codes: when you add your first passkey, security key, or authenticator app, we give you 10 one-time recovery codes. Keep them somewhere safe — each one gets you in once if you ever lose your devices. You can generate a fresh set anytime in Sign-in & security.

Browser support: passkeys work in up-to-date Chrome, Safari, Edge, and Firefox on computers and phones. Some in-app browsers (like the one inside Facebook or Instagram) don’t support them — open appsumo.com in your regular browser, or use your authenticator app instead.

For now, a passkey is the second step after your password or Google sign-in. Signing in with just a passkey — no password — is coming soon.

Lost your phone or authenticator app

If you've lost access to your authenticator app, you can still get in with a recovery code. On the sign-in page, choose "Use a recovery code" and type one in. Each code works once.

Once you're back in, go to Profile settings, open Sign-in & security, and set up the app on your new phone. While you're there, generate a fresh set of recovery codes.

If you don't have any recovery codes left, see the next section on getting back into a locked-out account.

Locked out of your account

If you've lost your authenticator app and have no recovery codes left, we can turn off two-factor for you. For your protection, this is a deliberate, multi-step process:

We'll ask you two questions about your account. One is about the card you paid with (its last 4 digits and expiry month and year). The other is an order number and its total, or a license code you redeemed.
Two people on our team check your answers.
There's then a 72-hour wait. We email every address on your account right away, and every day until it's done, with a link to cancel if it wasn't you.
When the wait ends, we turn off two-factor and sign you out everywhere. You sign in with your password and an emailed code, and can set up your app again.

The 72-hour wait can't be shortened. It's there so that if anyone other than you ever asks, you have time to stop it.

Confirming it's you before a change

Before sensitive changes — your password, email, Google or Facebook link, or signing out everywhere — we ask you to confirm it's you. Use your password or an emailed code, or your authenticator app if you have one.

Once you confirm, you have 15 minutes to make changes without being asked again. The confirmation applies to that browser and ends when you log out.

Security emails and "This wasn't me"

We email you about important changes to your account, like a new sign-in or a new email address. If the change was you, there's nothing to do.

If it wasn't you, use the "This wasn't me" button in the email. It signs your account out on every browser, removes any email address or Google or Facebook link added in the last 30 days, and emails you a link to set a new password.

You don't need to sign in to use it. The link works once and expires after 7 days.

Changing or removing email addresses

You can change your email yourself in Profile settings, under your email addresses. We'll ask you to confirm it's you first.

When a new address is added, we email every address on your account. If you added it, choose "Yes, this was me" in that email and confirm on the page it opens.

Why you can't remove an old address right away: older addresses stay on the account for 30 days after a new one is added. That way, if someone else ever added an address, your own is still there to recover the account. You can skip the wait if the new address was yours — open the "An email address on your AppSumo account changed" email sent to your older address and choose "Yes, this was me." After you confirm, you can remove the older address. (The confirm link expires after 7 days; if it expires, you wait out the 30 days.)

If two-factor is on and you're locked out, we can't change your email for you — we'd need to turn off two-factor first (see "Locked out of your account"). Once you're back in, you can change it yourself.

Google or Facebook login: If you've set up an authenticator app, we'll ask for the app code after you log in with Google or Facebook. A social login proves you own the inbox; the app protects your account even if someone gets into that inbox. Without an authenticator app, Google and Facebook logins go straight through with no code.

Scripts and API access: When two-factor or the sign-in check is on, signing in to our API with just a password won't work — a password alone can't answer the code we ask for. If a script or integration stopped logging in, contact us and tell us what it does, and we'll find the best way forward.