APPSINITYTwo-factor authentication
There is no two-step verification for developer accounts. A store settings row uses the words, and that is where the similarity ends.
Open Appsinity StudioWhat exists today
| Control | Reality |
|---|---|
| Email OTP at sign-up | Yes — one-time, 10 minutes, 6 digits |
| Email OTP on every login | No |
| Authenticator app or passkey | No |
| Recovery codes | No |
| Developer-account second factor | No |
| Store Security → 2-step verification | A settings row that persists locally; no server-side factor behind it |
| Store Login alerts | A row; no alerting service |
| Store Signed-in devices | Display only; no revoke control |
Why a Studio account is worth protecting
One login can rewrite a public listing, upload a build that is signed and served from appsinity.com storage, unpublish titles, invite team members and change payout details. Compromise is a supply-chain event for your players, not an account nuisance.
The password floor is six characters with no complexity rule, which is the weakest point in the chain.
localStorage. Anyone with the browser profile, or with an XSS foothold, holds a live publishing credential for a month.Controls you can apply now
- A long unique password from a manager, not six characters.
- A role alias for the account, so the mailbox is not one person's.
- A dedicated browser profile for Studio, with no other sites in it.
- Least-privilege team seats instead of sharing the owner login.
- Never "remember password" on a shared or borrowed machine.
- Sign out of Studio when you are done, so the 30-day token is not sitting in a browser.
- Log the current analytics baseline so an unauthorised change is visible.
If you think it is compromised
- Change the password. Immediately, through account recovery.
- Unpublish affected listings. The fastest way to stop a bad build reaching players.
- Audit the listings. Description, build URL, signing status, category, and any new team member.
- Check the payout method. A changed payout destination is the usual goal of a developer-account takeover.
- Report it. Email [email protected] and say plainly that you believe the account was accessed by someone else.
Frequently asked questions
Will two-factor be added?
Nothing in the current API implements it. Ask [email protected] if it is a requirement for your organisation.
Does the email OTP count as two-factor?
No. It verifies the address at registration; it is not a factor at login.
Can I revoke a stolen session?
There is no device list with a revoke control. A password change is the only lever, and the 30-day token is the reason to do it fast.
Developer publishing support: [email protected]
General support: [email protected]
Partnerships: [email protected]