Two-factor authentication

A password is one thing somebody can lose. A second factor is the difference between losing it and losing the company's customer list, its schedule and its payment settings.

Two-factor authentication is optional by default and per person. Each team member enrolls their own factors. A deployment can require enrollment; if it does, follow the setup screen before entering the app.

Turning it on

Open Settings → Security in the web app (/settings/security). You can enroll:

• An authenticator app: Google Authenticator, 1Password, Authy or any other app that reads a standard six-digit code.
• A security key or passkey: a hardware key, or the fingerprint or face unlock built into the phone or laptop you already carry.
• A text message: a code sent to your phone.

Enroll more than one if you can. Two ways in means a lost phone is an inconvenience rather than a lockout.

Recovery codes

Enrolling gives you ten single-use recovery codes. Each one signs you in once when you cannot reach any of your factors. Print them, or keep them somewhere that is not the phone they are there to replace: a recovery code in a note on the locked phone is not a recovery code.

You can regenerate them at any time, which invalidates the old set.

It applies however you sign in

The second step is asked for on every way into your account: with a password, and with every connected account: Google, Apple, Microsoft, Facebook, LinkedIn, X, Instagram and TikTok alike. Signing in through a social provider is not evidence that a second factor happened, so it does not count as one. See Sign-in and social accounts for how credentials sit on one account.

Signing in on the mobile app asks for the same second step: type the code from your authenticator app, or choose Use security key and follow the phone's prompt to hold your key to the phone, plug it in, or choose your passkey. If your account only has a security key and the phone cannot use one, sign in on the web, or add an authenticator app there first. You can enroll an authenticator app or a security key or passkey on the phone too; text-message codes are set up on the web.

Trusting a browser

You can let a browser you own skip the second step for 30 days. It is a convenience on your own laptop and a bad idea on a shared computer, and clearing every trusted browser at once is one of the actions below.

The actions that ask again

Security changes such as enrolling or removing a factor, regenerating recovery codes and clearing trusted browsers can ask for a recently verified factor. The default verification window is five minutes, including on a trusted browser; follow the prompt shown for your account.

Changing an existing password verifies the current password. Adding a first password can ask for a fresh factor when one is enrolled. Account deletion uses its own signed-in confirmation; it does not always ask for a new factor. Your sign-in email is read-only in Account settings.

If somebody loses everything

An owner cannot reset a colleague's second factor from inside the app. That would make the factor only as strong as the owner's own account. Contact support, who can reset it after checking who is asking. See Getting help.

What it does not cover

Two-factor protects a sign-in. It is not a substitute for giving people the role they actually need: somebody who should not be moving money should not have the permission to, whether or not their account has a second factor. See Team roles and permissions.

From the native app

Open Settings › Account › Two-step verification and passkeys in the app. From there you can:

• Add an authenticator app: choose Open in authenticator app or Copy setup key, then enter the code the app shows.
• Add a security key or passkey, and follow the phone's prompt.
• Remove a method, after a confirmation that names it.
• See Recovery codes once, with Copy codes and I saved them, or Generate new codes, which invalidates the old set.

Before a change, the app says "Before this change, confirm it's you with one of your sign-in methods." and asks for one of them. If your company requires a second step, Settings shows "A second sign-in code is required" until you add one.

Text-message codes, trusted devices and signed-in sessions stay on the web: use Open security settings on the web or More account settings on the web. A browser sign-in may be needed separately. Device biometrics protect opening the app; they do not enroll a server sign-in factor.

See Your account and Native version availability.