Short answer: Go to Settings → Security and Privacy → Security → Set Up Two-Factor Authentication. Twitch requires a verified phone number first, then lets you switch to an authenticator app. Scan the QR code, confirm the code, and save your backup codes. If you are an Affiliate or Partner, 2FA is not optional — Twitch requires it to stream.
Why Twitch takes this seriously
Twitch made two-factor authentication mandatory for Affiliates and Partners for a straightforward reason: a compromised channel is a live broadcast platform pointed at an existing audience. Hijacked channels get used to run crypto giveaway scams to thousands of viewers in real time, and the damage lands on the streamer’s reputation and the viewers’ wallets simultaneously.
There is also money directly attached — payouts, subscriptions, bits, and connected payment details. And for anyone with an audience, the channel itself represents years of work that cannot simply be rebuilt.
Even as a viewer, your account holds payment methods and subscriptions, and a hijacked viewer account is a useful vector for spamming chat with scam links from a name that looks trustworthy. The same holds across other social platforms, so it is worth turning on 2FA for Reddit and securing your Snapchat account too.
Step 1: Open security settings
- Sign in at twitch.tv on desktop.
- Click your avatar (top right) → Settings.
- Open the Security and Privacy tab.
- Under Security, click Set Up Two-Factor Authentication.
Use a desktop browser for setup. The mobile app supports 2FA at login but the configuration flow is smoother on the web.
Step 2: Verify a phone number
Twitch requires a verified mobile number before it will enable two-factor authentication. There is no way around this — enter the number, receive the SMS, and confirm it.
Two things worth knowing:
- Use a number you will keep. Changing it later requires access to the old one, which is a common lockout cause.
- Because your number is now tied to the account, set a port-out PIN with your carrier. Streamers are targeted for SIM swap attacks specifically because their accounts are valuable and public.
Step 3: Switch to an authenticator app
Once the phone number is verified, Twitch offers to use an authenticator app instead of SMS. Do it — this is the step people skip, leaving themselves on text codes.
- Choose the authenticator app option.
- Scan the QR code with your app, or use the text key for manual entry — see entering a setup key manually.
- Enter the six digits to confirm.
Any standard TOTP app works: Google Authenticator, Aegis, 2FAS, Microsoft Authenticator, Authy, or a password manager. See the best authenticator apps and, for the method comparison, SMS 2FA vs authenticator apps.
Do not screenshot the QR code. It contains the raw secret key — and for a streamer, an accidental on-screen reveal is a genuine hazard. If you are setting this up, make sure you are not live and not recording.
Step 4: Save the backup codes
Twitch provides one-time backup codes. Download them and store them offline or in an encrypted vault — see where to store 2FA backup codes safely.
For Affiliates and Partners this is doubly important: disabling 2FA also disables your ability to stream, so a lockout is not just an inconvenience, it is downtime and lost revenue. Read how to back up your authenticator app and put your token on a second device.
Step 5: Lock down the parts 2FA does not cover
Channel takeovers frequently happen without anyone logging in as you. Three things to check:
- Stream key — under Settings → Stream. Anyone with your key can broadcast to your channel without your password. Never show it on screen, and reset it if you have ever streamed your settings page. Reset it now if you are unsure.
- Connected accounts and extensions — under Settings → Connections. Revoke bots, overlays, alert services and analytics tools you no longer use. Many hold broad permissions including chat moderation and channel edits.
- Moderators and editors — under your Creator Dashboard roles. Remove people who are no longer involved, and make sure your editors have 2FA of their own.
Also check your email account’s security, since it controls the reset path — see our Google account guide.
Step 6: The scam aimed at streamers
The most effective attack on Twitch accounts right now is not technical. It is a professional-looking email or Discord message offering a sponsorship, a game key for review, or a brand deal, with an attachment or a link to a “contract portal”. The identical pitch lands on gaming and chat platforms, so it is worth setting up 2FA on Discord and protecting your Steam account as well.
The link leads to a login page that relays your password and code in real time, or the attachment carries an infostealer that takes your session cookies — which bypasses 2FA entirely because no login is needed. Our post on how 2FA gets bypassed explains the mechanism.
Practical rules: never open attachments from unsolicited sponsorship offers, verify brands through their official website rather than the email, and always navigate to twitch.tv yourself rather than clicking a login link.
Frequently asked questions
Do I have to give Twitch my phone number?
Yes. Twitch requires a verified number before enabling 2FA. You can move to an authenticator app afterwards, but the number stays attached to the account.
Is 2FA required to stream on Twitch?
For Affiliates and Partners, yes — it is required to broadcast. For regular accounts it is optional but strongly advised.
Which authenticator app should I use with Twitch?
Any standard one. Twitch uses normal TOTP — see how TOTP codes work. Use whichever app you already have rather than adding another.
Why is Twitch rejecting my code?
Usually clock drift on your phone. Enable automatic network time. Our guide to 2FA codes being rejected covers the other causes.
What if I lose my phone?
Use a backup code, or Twitch support with your verified phone number and email. Note that turning off 2FA suspends streaming for Affiliates until it is re-enabled. See recovering accounts after losing your 2FA phone.
Does 2FA protect my stream key?
No. The stream key is a separate credential that works independently of your login. If it leaks, someone can broadcast to your channel without touching your account — reset it under Settings → Stream.
The bottom line
Verify the number, switch to an authenticator app rather than stopping at SMS, save the backup codes, and reset your stream key if there is any chance it has been on screen. Then be sceptical of every sponsorship email that arrives with an attachment — that is how channels are actually being taken, not by guessing passwords.
Need a code while you set this up? Our free online 2FA code generator runs entirely in your browser.