Two-Factor Authentication (2FA)

Two-Factor Authentication (2FA)

What is 2FA?

Two-factor authentication (2FA) adds a second check to the website login. After entering their email and password, a user also enters a short code from an authenticator app on their phone. Even if a password is guessed or stolen, an account can't be signed into without that phone.

What it covers

2FA applies to signing in through the web — the admin site and the Customer Portal. It is checked only at login on the website.

The mobile app is not affected. The field app signs in with email and password only — it does not use a second factor. Turning on 2FA secures your web logins; app sign-in is unchanged. If gating the app behind a second factor is a requirement for your organisation, contact us so we can scope it with you.

Choosing who it applies to

2FA is set per site, with three modes:

We'd typically suggest starting on Staff Only — it protects your team's accounts without adding a step for your customers. The mode can be changed at any time.

First sign-in after it's switched on (one-time setup)

Nobody is locked out when 2FA is turned on. The next time each user logs in on the web, they're walked through a quick one-time setup:

1. They log in with their email and password as usual.
2. A QR code is shown on screen.
3. They open an authenticator app on their phone and scan the QR code.
4. The app starts showing a 6-digit code that changes every 30 seconds.
5. They type in the current 6-digit code to finish — and they're in.

Works with any authenticator app. There's nothing extra to install from us. 2FA uses the standard TOTP system that common apps support — for example Google Authenticator, Microsoft Authenticator, Authy, or a password manager like 1Password. Each person sets up their own; you don't pre-configure anything.

Every login after that

1. Enter email and password as normal.
2. Enter the current 6-digit code from the authenticator app.

The code check allows for a minute or so of clock difference between the phone and the server, so a code that just changed still works.

"Trust this device" — skip the code for 30 days

On the code screen there's a trust this device option. If a user ticks it on a computer they use regularly, that browser won't ask for a code again for 30 days (they still enter email and password). After 30 days — or on a different computer or browser, or if browser cookies are cleared — they'll be asked for a code again.

On shared or public computers, leave it unticked.

If someone loses or replaces their phone

There are no printed backup codes. If a user loses access to their authenticator app and their "trusted device" period isn't active, an administrator resets their 2FA from Configuration → Site Users → (the user) → Reset Auth. That clears their old setup, and the next time they log in they're shown a fresh QR code to set up again on their new phone.

Good to know

• Smooth rollout. Existing users aren't locked out — each is guided through the one-time setup on their next web login, so you can switch it on without a coordinated cut-over.
• Per-user. Everyone links their own phone; there's no shared code or central device to manage.
• Reversible. The mode can be turned back to Off, or changed between Staff Only and All users, at any time.
• Logged. Each 2FA login is recorded in the system's audit trail.

Troubleshooting