Two-Factor Authentication
Secure your account with TOTP-based two-factor authentication.
Last updated 16 Oct 2026
Two-factor authentication (2FA) is required for administrators, staff, Marketing, Auditor and custom-role members. If you hold one of these roles in any organisation, the requirement follows your account across organisations. Trainers without one of those roles can enable 2FA for their own account. Once enabled, an authenticator code is required at sign-in.
Access required
Sign in to manage your own authenticator and recovery codes. Two-factor authentication is mandatory for administrators, staff and members with custom roles. Trainer access follows the account security requirements shown at sign-in.
Supported authenticator apps
Any TOTP-compatible authenticator app works:
- Google Authenticator
- Authy
- 1Password
- Microsoft Authenticator
- Bitwarden
Enabling 2FA
Go to Security settings
Click your name in the bottom-left sidebar, select Account, then click the Security tab.
Start setup
If sign-in asks you to set up an authenticator, complete that setup before opening organisation records. Otherwise, click Enable Two-Factor Authentication on the Security page.
Scan the QR code
Open your authenticator app and scan the QR code displayed on screen.
If you can't scan the QR code, click the manual entry option and type the secret key into your authenticator app.
Enter verification code
Enter the 6-digit code shown in your authenticator app to verify the setup.
Confirm
Click Verify & Enable. Your account is now protected with 2FA.
Warning
Save the recovery codes shown after setup in a safe place. Each code can be used once. You can generate a new set under Account → Security; generating a new set replaces the old codes.
Signing in with 2FA
After enabling 2FA:
- Enter your email and password as usual
- When prompted, open your authenticator app
- Enter the current 6-digit code
- Click Verify to sign in
The code changes every 30 seconds. If your code isn't accepted, wait for a new one and try again.
Lost your authenticator
On the verification screen, choose Lost your authenticator? and enter one unused recovery code. The code removes the lost authenticator and signs you out. Sign in again and set up a new authenticator if your role requires one. If you have neither your authenticator nor a recovery code, contact support.
Disabling 2FA
Required roles cannot disable 2FA. The Security page explains when it is required for your account. If 2FA is optional for all your roles, you can remove your own authenticator:
- Go to Account → Security
- Click Disable Two-Factor Authentication
- Confirm in the dialog
Note
Disabling 2FA means your account will only be protected by your password. Consider re-enabling it if your circumstances change.