Cloudflare needs to fix up its old 2FA Authy-powered tokens

Cloudflare used to offer the option of an Authy-powered token for two-factor authentication. This was different from the standard TOTP two-factor authentication currently available that we can use not only with Authy, but also with other authenticator apps such as Google’s.

Nevertheless, the Cloudflare Authy-powered token still appears in the Authy app of users that previously used it, even after they deactivated it.

That’s what happened with me. Months ago I turned off two-factor authentication for Cloudflare, but Authy still lists it under “Twilio Authy Accounts” (a dedicated section for Authy-powered tokens).

This is what Authy says about these accounts:

Please note, Authy-powered tokens will not be deleted unless that partner’s server sends a request to Authy’s API to turn off 2FA for you. If you believe you have turned off 2FA and the token persists, please contact the support team of that partner to see if there is a problem turning off 2FA, to ensure that you will still be able to access your account without any problems in the future.

That’s what I’m doing now. I hope you can help me – and all the other users who are facing this problem:

4 Likes

Hi @sen,

I do seem to be able to confirm this. I can hide the old Cloudflare account in Authy but not remove it.

I’ll escalate this for the attention of the Cloudflare Support Team but there is a very long queue for those without support included in their plans so it may take a while to get a response.

2 Likes

Same thing happens with Pinterest.

1 Like

Hi @sen, sorry for the issues you are facing here. I have gone ahead and created a ticket for this issue and we will be back in touch with an update as soon as possible.

3 Likes

The support solved my issue. I told them my Authy details (email, phone number, ID), they found my account and removed the Authy-powered token.

3 Likes

Cloudflare can’t remove Authy tokens manually anymore.
Here’s the response I got from CF support:

Due to a recent migration on Authy’s side we can no longer manually remove this for you in Authy’s admin UI.

I took that info, and I contacted Authy support ([email protected]) with it:

I can’t seem to be able to remove the Cloudflare token from my Authy account.
CF used Authy in the past, but at this time, they are not offering this option anymore. They did not provide me with a way to remove the token, and when I reached out to them to remove it manually, they say (see below) that you (Authy) don’t provide them with the tools to do so anymore, so they can’t help us.

Can you please remove the Cloudflare token from my account?

And indeed, after providing a token they sent me via SMS, they were able to remove the CF token from my Authy account. Yay. (Turnaround time was around 2 days, for Authy support.)

Of note: [email protected] might not work after May 15, 2023:

In an effort to better streamline ticket submission and to improve the overall customer experience and response times, all email ingress points (some exceptions will be applied to legacy offerings) for Twilio Customer Support will be deprecated as of May 15, 2023. This update will impact all previously used email addresses for Twilio, Authy and SendGrid support.

If someone reaches Authy support after May 15, can you detail what channel you used?

Cheers.

1 Like

There’s now a floating chat icon on the bottom right corner of the authy web page. It steers users through some suggested articles, but allows a support request to be opened after a few clicks.