How to secure your portal account with two-factor authentication (2FA)

Your portal account holds your customers, your panel logins and your payment gateway keys. With two-factor authentication (2FA) on, a password alone is not enough to sign in: you also enter a 6-digit code from an authenticator app on your phone.

Everything in this guide is on one page: Settings → Team & security → Security (the page is called Security Settings).

1Step 1 of 5Use a strong password

On Security Settings, use the Change Password box. Enter your Current Password, then the new one under New Password and again under Confirm New Password, and click Change Password.

Use at least 12 characters with upper and lower case letters, a number and a symbol, and don't reuse a password from another site. You can't reuse one of your last 5 passwords.

After the change, every device that was signed in with the old password is signed out within a minute, including the one you are using. Sign in again with the new password.

2Step 2 of 5Turn on two-factor authentication

In the Two-Factor Authentication (2FA) box, click Enable 2FA. A QR code appears.

Open an authenticator app on your phone and scan the code. If you can't scan it, type the code shown under the QR code into the app instead.

3Step 3 of 5Confirm with a code

Type the 6-digit code from the app under Verification Code and click Enable 2FA. The box now shows Enabled.

4Step 4 of 5Save your backup codes

The Your Backup Codes window shows 10 one-time codes. You won't see them again. Click Download Codes or Copy to Clipboard and keep them somewhere safe that is not your phone, then click I've Saved My Codes.

The 2FA box shows how many backup codes you have left. To get a fresh set, click Regenerate Backup Codes, enter a code from your app and click Regenerate Codes. The old codes stop working right away.

5Step 5 of 5Sign in with your code

From now on, after your email and password the sign-in page asks for an Authentication code. Enter the 6-digit code from your app and click Verify code.

Lost your phone? Type one of your backup codes in the same box instead (with or without its dash). Each backup code works once.

Add a passkey (optional)

A passkey lets you sign in with Face ID, Touch ID, a fingerprint or a security key instead of typing your password. In the Passkeys box, click Add Passkey. In Register a Passkey, give it a name you will recognise (for example the device) and click Register Passkey, then follow your device's prompt.

On the sign-in page, click Sign in with Face ID / Passkey to use it.

Check where you are signed in

Active Sessions on the same page lists the browsers and devices signed in to your account, with their IP address and when each was last active. Login History lists recent sign-in attempts, including failed ones.

To sign out one device, click Revoke Session next to it. To sign out everything except the device you are using, click Logout All Other Devices. Signed-out devices are refused within a minute.

If you see a device or a sign-in you don't recognise, click Logout All Other Devices and change your password straight away (step 1). Then make sure 2FA is still enabled.

Settings → Team & security → Security monitoring (the Security Monitoring page) lists security events for your account.

Your team

Everyone you invite under Settings → Team & security → Staff signs in with their own account and password. When someone leaves, or no longer needs access, open the actions menu on their row and click Suspend Access (you can restore it later) or Remove from Team.