Two-step verification

Two-step verification adds a second check to your back-office sign-in: after your password you enter a 6-digit code from an authenticator app on your phone. It protects your account if someone learns your password. It is optional, and you set it up per person under My account.

Before you start

• You need an authenticator app on your phone, such as Google Authenticator, 1Password or Authy.
• Only an authenticator app is supported. There is no SMS code, no passkey and no email code for this step.
• Two-step verification applies to the back office. It does not change POS PINs or staff-portal codes (see login).
• You need your current password to turn it on or off.

Turn it on

1. 1Open My account and choose Security.
2. 2On the Two-step verification card, enter your password under Your password and choose Start setup.
3. 3Scan in your app: scan the QR code. If you cannot scan, copy the key under Can't scan? Enter this key manually into the app.
4. 4Save your backup codes: copy or write down the list. Each code works once if you cannot reach your phone.
5. 5Confirm the code: enter the 6-digit code from the app and choose Verify and turn on.

The card then shows On. If you cancel before the last step, nothing is turned on.

Sign in with it

1. 1Sign in with your email and password as usual.
2. 2On Two-step verification enter the 6-digit code from your app under Verification code, then choose Verify.
3. 3Optional: turn on Trust this device to skip the code on this device for 30 days. Only use it on a device that is yours and protected by a lock screen.

If you lost your phone

On the Two-step verification screen choose Can't use my phone — use a backup code, enter one backup code and choose Verify. A used code cannot be used again (Backup code is invalid or already used.). Afterwards set up the app on your new phone: turn two-step verification off, then on again.

Without your phone and without a backup code you cannot complete the sign-in. Keep backup codes safe.

Renew backup codes

When the list runs low, or after someone may have seen it, open Security and on the Two-step verification card choose Renew backup codes, enter your password and choose Generate new codes. The old codes stop working at once.

Turn it off

On the card choose Turn off, enter your password and confirm with Turn off two-step verification. Your account is then protected only by your password.

Active sessions

The Active sessions card on the same page lists the devices signed in to your account, with This device marked and a valid until date. Choose Sign out next to a session, or Sign out other sessions to end every session except this one. Do this if you used a shared computer. More in security.

Common questions

The code is rejected

The message Code not accepted. Enter the current code from your app. usually means the time on your phone is off or you typed an old code. Check that your phone's clock is set automatically, then wait for the next code.

Do my staff need it too?

Two-step verification belongs to each person's own account. Everyone turns it on for themselves under My account.

If something goes wrong

Check login for sign-in problems and password-reset if you also forgot your password. For anything else use contact-support.