When you enabled 2FA you would have been given a list of recovery codes. You should first try to use one of those to access your account.
If you do not have backup codes then login with your username and password. When you reach the screen to input your 2FA code, click ‘Can’t access your 2FA device or backup codes’.
This will then walk you through the process to recover access to your account. You will need to verify your email and verify a device you have used previously to login. It will then take 3-5 days for Cloudflare to review your request.
What’s the procedure if you don’t have a device previously used to verify? I see some providers will verify email, and send another email to that 2FA scheduled to be deactivated after 72hrs etc..
which seems a pragmatic balance.
It depends, but in the worst case scenario the only option is to start over in a new account. That is why it is crucial to safely store emergency MFA recovery codes. It is also advisable to have more than one user with super administrator access to the account.
Even when another option to manually reset the MFA exists, it still far more disruptive than being able to self-recover with emergency one-time use codes.
