Your login and two-step sign-in
Two-step sign-in asks for a code from your phone as well as your password, so a stolen password can't change payment accounts, tax numbers, your data export, who has access, or hand over the business. A passkey or Apple counts as two-step: no code is asked after them.
Back office (your name) Security Two-step sign-in
- Open your name at the bottom of the sidebar › Security.
- Tap Set it up · 1 minute.
- Scan this with an authenticator app (Google Authenticator, Microsoft Authenticator, 1Password or any other). Can't scan? Type the key shown.
- Type the 6-digit code it shows and tap Turn on.
- Save your recovery codes (Copy or Download), somewhere safe and not on the same phone, then I've saved them.
Example
An owner sets it up
Sam scans the code with Google Authenticator, types 482 913, and downloads the 10 recovery codes to the office computer. From then on, changing the tax number asks for the code from the app; it won't ask again for 15 minutes on that browser.
I lost my phone
At sign-in, tap Lost your phone? Use a recovery code and type one of the codes you saved. It removes the lost phone; set up the new one in Security.
I signed in with a passkey. Why no code?
A passkey counts as two-step: the device plus your face, fingerprint or screen lock. Before sensitive changes you confirm with Use Touch ID (one touch) instead of the code. Apple counts too; Google and passwords still ask for the code.
Do till staff need two-step sign-in?
No. Staff sign in on the till with a PIN. Two-step is for the back office.
If it goes wrong
"Turn on two-step sign-in first"
That change needs two-step sign-in. Tap Set it up · 1 minute, then try again.
If it goes wrong
The code isn't accepted
Check the phone's time is set automatically (codes depend on it), and type the newest code before it changes.
Related: People with a login · Hand over the business