Two-factor authentication
Add a second step to signing in, so a stolen password is not enough.
Two-factor authentication adds a code from an authenticator app on top of your password. Turn it on from Account Settings, scan the QR code, and enter the six-digit code. There are no backup codes, so before you turn it on, use an authenticator that backs up to the cloud or add a second device. Losing your authenticator means contacting support.
Your dashboard holds every conversation your visitors have had, their contact details, and a live connection to your CRM and calendar. A password alone is thin protection for that.
Two-factor authentication adds a second step: a six-digit code from an app on your phone, which changes every thirty seconds. Somebody with your password still cannot get in.
Turning it on
You will need an authenticator app. Any of these work:
- Google Authenticator
- 1Password
- Authy
- Microsoft Authenticator
- Go to your account settings and find Two-factor authentication.
- Select Turn on two-factor.
- Scan the QR code with your authenticator app. If you cannot scan it, there is a key you can type in instead.
- Enter the six-digit code your app shows.
- Select Verify & turn on.
From then on you will be asked for a code when you sign in.
There are no backup codes. Read this before you turn it on.
If you lose access to your authenticator app you cannot reset this yourself. You will have to contact support and wait.
Before you turn it on, do one of these:
- Use an authenticator that backs up to the cloud, such as 1Password or Authy, so a lost phone is not a lost account.
- Or add a second device now, while you can, using Add another authenticator.
Setting it up on a single phone with no backup is the one way this goes badly.
If a code is rejected
Almost always the clock on your phone has drifted. Authenticator codes depend on the time being right to within a few seconds. Turn on automatic time setting on your phone and try again.
Otherwise, check you are reading the right entry in your app if you have several, and that you have entered it before it expires.
Turning it off
You can turn it off from the same place, and you will be asked for a current code to prove it is you. If you have just reloaded the page you may be asked to confirm your code again first.
If you have lost your authenticator
Contact support. We will verify who you are and reset it. Have your account details ready, and expect this to take longer than a self-service reset would, because that delay is the point.
Who should turn it on
Anybody with dashboard access, and especially:
- Accounts that can change billing.
- Accounts connected to a CRM holding customer data.
- Any shared or admin account.
If a customer of yours ever audits your security, this is one of the first questions they ask.