Skip to content
English
Customer portal
Go to reloadly.com
  • There are no suggestions because the search field is empty.

2FA + IP Whitelisting: Because "password123" Isn't Cutting It

Step-by-step guide on how to enable the 2FA on your Reloadly Portal Account

Security

Two locks on your account: 2FA and IP whitelisting

Why both are mandatory, how to set each one up, and what stops working if you skip them.

Setup time

5 minutes

Level

Basic

Status

Mandatory

Keeping your account safe and accessible only to you is our top priority. Since March 13th, 2023, every Reloadly account has been required to use two-factor authentication (2FA), and we strongly recommend pairing it with IP whitelisting on your production traffic.

1

What is two-factor authentication?

Two-factor authentication (2FA) requires you to provide two different types of information to access your account, instead of just a password. It gives the system extra proof that you really are the rightful owner of that account.

2

Enable 2FA in 5 steps

 
Dashboard Wallet Security Developers

2 factor authentication

All accounts are required to use 2FA. Please enable it as soon as possible.

  • Upon login, you'll get a prompt to scan a QR code
  • Validate with the OTP via Google Authenticator, Authy, DUO, or Auth0 Guardian
Enable
  1. On your dashboard, go to the Security section.
  2. You'll see the 2FA panel listing the supported apps — Google Authenticator, Authy, Auth0 Guardian, and DUO. Click Enable.
  3. You'll get a dashboard notification confirming 2FA has been enabled.
  4. As an extra safeguard, you'll also receive an email from the Reloadly team confirming the change.
  5. You'll be redirected to log in. The first time, you'll see an option to scan a QR code with one of the apps above.

Apps you can use to scan the code: Google Authenticator, Auth0 Guardian, DUO Mobile, and Authy.

ℹ️ Once enabled, 2FA also secures everything tied to your account — including your API client ID and API client secret.
3

Why we enforce 2FA

A password alone isn't enough against persistent attackers — malware, brute force, data breaches, and phishing can all be used to steal one. If your password is ever compromised, 2FA adds an extra layer that requires your phone too, making your account significantly harder to break into.

4

IP whitelisting

As one of our security best practices, we recommend enabling IP whitelisting for your production traffic. When you whitelist your production server IPs, Reloadly only accepts traffic coming from those specific servers.

Add an IP to your whitelist

When you whitelist your production server IP addresses, only traffic from those servers will be accepted by Reloadly.

If your servers run on a public cloud like AWS or GCP, check with your provider on how to get stable IPs, or consider routing traffic through a proxy with a stable IP.

Manage whitelist

To whitelist your IP, send your server's IP address from your registered account email to tickets@reloadly.com.

Important: IP whitelisting doesn't apply if you're using our SDKs to build mobile apps where API calls originate from end-user devices (phones, tablets) — those IPs change constantly. In that case, focus on strong security on the mobile app side instead.

🔒 Why both matter for your products

For products like gift cards, purchases can't be completed unless both 2FA and IP whitelisting are properly enabled on your account. If either one is missing or misconfigured, expect transactions on these products to be blocked until both are set up correctly.

❓ Frequently asked questions

Is 2FA optional?

No. Since March 13th, 2023, every Reloadly account is required to use 2FA to access the dashboard.

My servers are on dynamic IPs — can I still whitelist them?

Check with your cloud provider on getting stable IPs for production, or route your traffic through a proxy server with a fixed IP you can register instead.

Do I need IP whitelisting for a mobile app built with Reloadly's SDK?

No — it doesn't apply when API calls come from end-user mobile devices, since those IPs vary constantly. Focus on securing the mobile app itself instead.

Why are my gift card purchases failing even though my account looks fine?

Double-check that both 2FA and IP whitelisting are fully enabled — some products, including gift cards, require both before transactions can go through.

Questions about securing your account?

We'd love to hear from you.

Contact support →