Galagames
Galagames supports authenticator codes for password-based account verification
Galagames supports time-based two-factor authentication, or 2FA, for password-based account access and selected account actions. Pairing an authenticator requires the account's QR code or manual setup key, followed by a valid app code. The account settings determine which actions request that extra credential. Email login remains available during the wallet-only transition announced on October 5, 2026. Wallet-based access relies on wallet credentials, which need their own protection.
The setup secret links the app to the account
The authenticator generates a time-based one-time password, or TOTP, from the setup secret and the device clock. Your account validates the submitted code against its corresponding secret and permitted time window. QR scanning and manual key entry provide the app with the same underlying setup information. The manual route matters when the camera cannot scan the displayed code. Neither route makes a code interchangeable with a code for another account.
A service label and associated email help identify the correct entry inside the app. A descriptive label alone does not establish that its stored secret matches the account.
Account setup proceeds from pairing to saved verification settings
If your account still offers password-based settings, open the profile menu, select Account and find Two-Factor Authentication under Security. The Set up Now prompt can also lead into setup. Have the authenticator available before proceeding, and preserve the backup phrase that appears beneath the QR code.
| Setup stage | Control over access |
|---|---|
| Pair the authenticator | The app stores the account's setup secret after QR scanning or manual entry; you control its protected backup. |
| Confirm the app code | The account checks the six-digit code after you select Enable; adding the app entry alone does not confirm activation. |
| Save verification settings | You select the available actions that require 2FA, then use Update to activate those choices. |
| Protection scope | Account prompts follow these settings; separate wallet credentials continue to govern wallet access. |
The documented mobile setup requires a phone that can run a compatible authenticator app. App-specific installation and backup options remain separate from the account settings that govern verification.
Verification settings determine which account actions request a code
The available verification categories cover account changes, login, transactions, purchases, account deletion, Transfer Code resets that use a wallet recovery phrase and private-key downloads. Sensitive wallet-related changes have their own entries, so the label 2FA enabled does not reveal the complete selection. Review the choices that your account actually exposes, especially before treating sign-in verification as coverage for another action.
These selections govern prompts inside the account interface. They do not add authenticator enforcement to an external wallet that signs independently.
A protected setup secret preserves authenticator access
The setup secret can restore code generation, so its confidentiality matters beyond the expiry of any single code. Authenticators with matching secrets and TOTP settings generate identical codes for the same time window. A screenshot of the setup QR code can expose that secret just as manual key text can. A backup therefore belongs in protected storage that you can recover if the phone disappears. Public screenshots, shared folders and messages can create additional copies outside your control.
The 2FA backup phrase serves the authenticator setup. A wallet recovery phrase serves wallet recovery, so the two records have different purposes.
An app that offers synchronization or device export may keep another copy of the authenticator data. Its configuration determines where that copy resides and how you regain access. Protect any synchronization account as well, since it may hold a usable copy of the same secret.
A lost phone can block login when the account requires 2FA and no usable backup remains. Gala Support handles requests to remove account 2FA when users cannot satisfy the prompt. The request concerns account access; it does not recover wallet keys or reverse a blockchain transfer. Never include the authenticator secret or wallet credentials in a support message.
Code rejection can reflect mismatched entries or device time
The account entry and device clock determine whether a fresh-looking authenticator code corresponds to the expected value. An expired code, a code from another service or an entry containing an older setup secret can fail verification. Correct device time addresses a clock mismatch; it does not fix the wrong secret. Keep the phone's date and time synchronized through its operating-system settings. Removing a working entry before checking these differences can eliminate the code generator that the account expects. Retain accessible authenticator data while investigating the mismatch.
Distinguish a rejected code from a missing entry: timing checks cannot recover authenticator data that the app no longer holds.
Email login checks use a separate verification channel
The email verification channel checks unfamiliar login IP addresses independently of the authenticator's time-based code. In the documented password-login flow, a changed IP address can trigger an eight-digit code sent to the account email. The app supplies a six-digit code for its own prompt. Enter the credential that the specific prompt requests. Receiving an email code does not show that app-based 2FA has been removed, and an authenticator code does not replace the email check.
The mailbox is another access dependency during password-based login. Use a different password for it and the gaming account, so a reused credential does not expose both.
Wallet-only access changes the credential that controls entry
Wallet-only access replaces the password-login route with authentication through a wallet that controls the existing account. The October 5, 2026 transition announcement keeps email login available during the change and leaves the retirement timeline for a later update.
GalaConnect's Export to Web3 Wallet feature uses the existing wallet key to preserve access to the same account. Its export process uses the Transfer Code to reveal that key. The GalaChain Transfer Code and the authenticator setup secret have different purposes; an account verification code does not replace wallet authorization.
Anyone who obtains the private key can control the wallet independently of an account's authenticator settings. Protect the key's backup and review what a signing request authorizes before approving it. Password-and-code access depends on two account credentials. Wallet access instead depends on control of the signing key for the requested action.
Details worth knowing about Galagames
Do I need mobile reception to generate a Galagames authenticator code?
A time-based authenticator can generate codes offline once it holds the setup secret and correct time. Accessing the account website still requires an internet connection. Cloud restoration and clock synchronization are separate functions that may need connectivity, even though local code generation does not require an SMS delivery.
Is it safe to send a Galagames authenticator code to someone claiming to be support?
Enter a live authenticator code only into the account prompt for an action that you initiated. Someone who already has your password may use a disclosed code to complete verification while it remains valid. A support message or claimed staff identity does not make sharing the code safe.
What should I do if a Galagames login email arrives without a sign-in attempt?
An unexpected legitimate login-verification email can signal an unauthorized sign-in attempt. Open the account through a saved, trusted login destination, reset the account password and contact Gala Support. Avoid following an unexpected message's link. A request for verification does not by itself establish that the attempt succeeded.
Does Google Authenticator require a Google Account for Galagames 2FA?
Google Authenticator can generate local codes without a Google Account. Signing in to Google enables its account-based synchronization feature. If you use the app without synchronization, its manual device-transfer option requires access to the old device containing the codes. The Google sign-in and your Galagames login remain separate.
What happens if I delete a synced Galagames entry in Google Authenticator?
Deleting a synchronized entry in Google Authenticator also deletes that entry from devices using the same synchronized Google Account. A synchronized copy therefore does not provide an independent backup against that deletion. A separately protected setup secret offers a different recovery route from copies that share the same synchronization account.