As first noted by AppleInsider, Apple has started rolling out two-step verification for iCloud.com, allowing iCloud users who opted-in for the authentication system to sign into web apps through a verification code sent to a trusted device.
Previously, iCloud.com web apps only supported basic logins with Apple IDs. Originally launched in March 2013 and expanded to more countries in February 2014, two-step verification adds an extra layer of authentication through a trusted Apple device (such as an iPhone or iPad) that will receive a four-digit confirmation code. After signing in with their Apple IDs, users will need to enter the security code, otherwise they won't be able to access their accounts.
On iCloud.com, two-step verification locks all the web apps available on the service except for Find My iPhone, which is left unlocked to let users recover a lost device. At the moment of writing this, I was only able to receive a confirmation code via SMS (here's Apple's official list of supported countries and carriers) as the over-the-air option wasn't working. As an additional sign of the fact that Apple may still be rolling out the feature, several international iCloud.com users who are using two-step verification on their accounts told us can't see the new authentication option on iCloud.com at the moment.