Turn on two-factor authentication (and why it's required)

Pennyweight requires a second factor on your account before it lets you connect a bank or authorize your AI. The setup wizard has no two-factor step, so you turn it on later in Settings → Security. It takes one pass through your account window.

New to Pennyweight? Finish creating your account and passphrase first.

Why it's required

Pennyweight requires a verified second factor before it will:

• authorize an AI connection;
• connect a bank, or reconnect one that needs it;
• disconnect a bank;
• turn on extra bank details for a connected bank.

The bank connection page explains that Pennyweight's bank integration, Plaid, asks for two-factor before any connection. AI access uses the same protection. Pennyweight's servers run this check on each of these steps, so it can't be skipped from the browser. See how bank connections are secured.

How to do it

1. Open the web app and go to Settings → Security.
2. Find the Two-factor authentication card. It shows Off until you set it up.
3. Select Manage. Your account window opens.
4. Follow the steps in that window to add a second factor.
5. Close the window. The card now shows On.

You can also start from Settings → Profile → Manage account, which opens the same window. If you haven't set up two-factor yet, the home screen may show a "Two-factor in one minute" banner; its Set up two-factor link takes you to the Security settings.

What you'll see

With two-factor on, the Security card reads "On. A second factor is required to grant AI access and connect a bank." The Profile card reads "Two-factor authentication on."

If you try a protected step without it, Pennyweight stops and points you here:

• On the bank connection page, you'll see Two-factor authentication required with a Set up two-factor button.
• On the page where you authorize your AI, you'll see a message after you select Authorize saying AI access uses the same two-factor protection as bank connections. Turn it on, then retry. See can't authorize your AI.

Good to know

• Just turned it on and still blocked? Pennyweight can remember the last check for up to a minute. Wait a minute and try again.
• Turning it off disconnects your AI. Every AI connection is revoked when two-factor is turned off. Your bank connections and data stay as they are. Turn two-factor back on and reconnect each AI client you still want. See manage AI access.
• It doesn't replace your passphrase. Authorizing an AI still asks for your passphrase each time, and still requires two-factor to be on.
• Next steps. With two-factor on, you can connect your AI or connect a US bank or card.