Turning on two-factor authentication

Two-factor authentication means a password alone is not enough to sign in. Given that your workspace contains your customers’ conversations, it is worth the ten seconds it costs you each morning.

Setting it up

Settings → Security → Two-factor authentication.

1. Scan the QR code with an authenticator app. Any of them work.
2. Type the six-digit code it shows, to prove it is set up correctly.
3. Save your recovery codes.

Step 3 is the one that matters

Recovery codes are how you get in when your phone is lost, broken or wiped. Each works once.

Save them somewhere that is not the phone with the authenticator on it. A password manager is ideal. Printed and in a drawer is fine. A screenshot in the photo roll of the device you are protecting is not.

Without them, losing your phone means proving who you are to us by email, which takes days rather than minutes, and is meant to. See I’ve lost access to my account.

Requiring it for everyone

An owner can make two-factor mandatory for every member of the workspace, in workspace settings. Members without it are asked to set it up before they can carry on.

Worth doing if your workspace holds anything sensitive, which it does: other people’s names, email addresses and problems.

Passkeys are not a replacement

A passkey is a better sign-in and removes phishing, which two-factor does not. Keep both. A passkey covers the device you have; two-factor covers the day you sign in from somewhere else.

Changing phone

Turn two-factor off and on again on the new device, while you can still sign in on the old one. Doing it in that order takes a minute. Doing it afterwards means using a recovery code, which is what they are for but is more work.

Last updated 22 September 2026.