Security and privacy
How to turn on two-step verification (2FA)
In Settings › Security, click Turn on, scan the QR code with an authenticator app (Google Authenticator, 1Password or similar) and confirm with the 6-digit code. It’s optional for every role and applies to every organization you sign in to with the same email.
Step by step
Open Security
Go to Settings › Security. The Two-step verification card shows Off. Click Turn on.
Scan the QR code
In the authenticator app on your phone, add an account by scanning the QR code. If you can’t scan it, use the Key for manual entry.
Confirm
Enter the 6 digits the app shows in the Code field and click Turn on. Back on the Security page, the status changes to On.
Why it’s worth it
The dashboard holds your WhatsApp conversations, your customers’ data and access to your integrations. With two-step verification, a password alone isn’t enough to get in: anyone who finds out your password would still need your phone. It’s especially recommended for owners and managers, who handle the team, integrations and billing.
What signing in looks like
After your email and password, the Two-step verification screen asks for the 6-digit code from the app. Enter it and click Verify. Each code is valid for a few seconds and works only once; if you get it wrong, wait for the next one. Without two-step verification turned on, you sign in with just your password.
The code step has a time limit: if you leave the screen open for more than 10 minutes, sign in again with your email and password. Entering the wrong code too many times in a row also makes you start over, and there’s a daily limit on wrong attempts.
Example: the Example Co. team
At Example Co. (fictional data), Ana, the owner, and Paula, the manager, turned on two-step verification on day one. In Settings › Team, the 2FA column shows On for both of them and Off for the salespeople, whom Paula reminded to turn it on too. Since Paula is also a member of a client’s organization, the verification applies there as well, with the same app.
Turning it off
In Settings › Security, enter the code the app is showing right now in App code and click Turn off. The page confirms “Two-step verification turned off.”
There are no recovery codes. If you switch phones, turn off two-step verification on the old phone and turn it on again on the new one. If you lose your phone while it’s turned on, get in touch with us.
What two-step verification doesn’t cover
- It’s personal: each person turns on their own. Managers can see who has it on, but they can’t turn it on or off for anyone else.
- There’s no list of open sessions. To sign out of a computer, use Sign out in the user menu.
Didn’t work? See…
- “Invalid code”: make sure your phone’s clock is set automatically (a code generated with the wrong time won’t match) and that you’re looking at the right account in the app.
- “Too many attempts”: wait the time shown and try again.
- “Too many invalid attempts. Log in again.”: go back to the sign-in page and sign in again with your email and password.
- I forgot my password: see Password and access.
Frequently asked questions
Is two-step verification required?
No. It’s optional for every role, and recommended. Once you turn it on, you enter the code every time you sign in.
Which authenticator app should I use?
Any app that generates 6-digit codes from a QR code, such as Google Authenticator or 1Password.
Do I need to turn it on in each organization?
No. Two-step verification belongs to your email and applies to every organization you sign in to with it.
See the path from ad to sale in your WhatsApp.
Try TraceClose free for 7 days with your team. No card needed to try.