How do I turn on two-factor sign-in?

Settings, then Two-factor sign-in. Two methods: an authenticator app (scan the QR code, then confirm with a six-digit code), or codes emailed to your account address.

Once on, sign-in asks for the code everywhere — app and website. If both methods are on, the authenticator is the one asked for.