With two-step sign-in on, someone who learns a password still can't sign in: they would also need that person's phone. You need an authenticator app on your phone. If you don't have one, install one from your phone's app store.
Turn it on for your own brand admin sign-in
- Sign in to your brand admin and click Your profile.
- Under Two-step sign-in, click Turn on two-step sign-in.
- In the authenticator app, add an account and scan the code on the screen. If you can't scan it, click Copy key and type the key into the app instead.
- Type the 6-digit code the app shows and click Turn on.
- Save your ten recovery codes: click Copy codes or Download codes and keep them somewhere safe. Then click I saved my codes.
In the app, the account is named after your brand. From now on, signing in asks for your password and then the Authentication code from the app.
Require it for all staff
- Open your Owner Account, choose the brand and click Staff access.
- Under Two-step sign-in for staff, turn on Require two-step sign-in for all staff.
- Click Require it.
Nobody is signed out. Anyone on your team without two-step sign-in sees Set up two-step sign-in the next time they sign in, and can't open anything else until it is done. New staff set it up when they accept their invite. While it is required, staff can't turn it off on their own.
Reset it when someone loses their phone
- Open Staff access in your Owner Account, or System → Staff & roles in the brand admin.
- Find the person. People who use it show Two-step on.
- Click Reset two-step sign-in, then click Reset two-step sign-in again to confirm.
Their old codes and recovery codes stop working, and we email them to say so. They stay signed in where they are now. If two-step sign-in is required, they set it up again at their next sign-in. In the brand admin you need Invite, change roles, remove staff, and only the owner can reset the owner's own brand admin sign-in.
If you lose your own phone
On the sign-in page, after your password, click Lost your phone? Use a recovery code and type one of your saved codes. Each code works once. For your brand admin sign-in, you can also reset it from Staff access in your Owner Account. Nobody can reset the two-step sign-in of your Owner Account itself, so keep its recovery codes safe.
Keep your recovery codes somewhere other than your phone, like a password manager or a printed page. They are shown only once.
Common problems
It says That code is not right
Check that your phone sets its time on its own, then type the newest code. Each code works once, so if you just used it, wait for the next one.
I used up my recovery codes
On Your profile, turn two-step sign-in off and on again to get ten new codes. If it is required for staff, ask the owner to reset it, then set it up again.
A staff member can't open anything after their password
Two-step sign-in is required and they haven't set it up yet. They finish Set up two-step sign-in with their phone. If that step timed out, they sign in again.