Two-factor authentication (2FA) asks for a 6-digit code from your phone after your password, so a stolen password on its own is not enough to get into your account.
It is optional and available to owners and admins. Your staff are not affected — clocking in and out does not change, and nobody else has to install anything.
Turning it on
- Install an authenticator app if you do not have one. Google Authenticator, Microsoft Authenticator, Authy and 1Password all work.
- Go to Settings → Account and find Two-Factor Authentication.
- Click Turn on two-factor.
- Scan the QR code with your authenticator app. On the mobile app there is no QR code — tap Open my authenticator app instead, since you cannot scan a code with the same phone that is showing it.
- Save the setup key shown underneath into your password manager. This matters — see below.
- Type the 6-digit code your app is showing and click Verify and turn on.
Two-factor is not switched on until that last step succeeds, so if you close the page halfway through, nothing changes and you can start again.
Signing in afterwards
Enter your email and password as usual, then a second screen asks for the code. Codes change every 30 seconds, so use whichever one your app is showing at that moment. This applies on the website and in the mobile app.
If you lose your phone
There are no printable backup codes — the setup key you saved is the recovery method. Add it to an authenticator on your new phone and you are back in.
If you no longer have that key either, contact us. We can switch two-factor off for your account once we have confirmed who you are. Your password and data are unaffected, and you can set it up again afterwards.
Turning it off
Go to Settings → Account and click Turn off two-factor. You will be asked for your password and a current code. That is deliberate: it means someone who finds your computer already signed in cannot quietly remove your second factor.
Good to know
- Signing in with Google or Apple? The setting will tell you that your two-factor is managed there instead. Turn on two-step verification in your Google or Apple account and it applies when you sign in here.
- Codes always rejected? Check your phone's date and time are set automatically. A clock that is out by even a minute makes every code wrong.
- Turning 2FA on does not sign you out anywhere, and it does not affect kiosk PINs or staff logins.