Platform · 3 min read
Two-factor & account security
Protect your login with two-factor authentication, keep your recovery codes safe, change your email securely — and, as an owner, require 2FA across your team.
Your account holds client contact details and your studio's money, so it's worth locking down. Two-factor authentication (2FA) adds a second step at sign-in — a short code from an app on your phone — so a stolen password isn't enough on its own.
Turn on two-factor
1Settings → Account & security → Two-factor. Confirm your password to begin.
2Scan the QR code with an authenticator app — Google Authenticator, 1Password, Authy or similar — or type the key in by hand. Enter the 6-digit code it shows to verify.
3Save your recovery codes. You get ten one-time codes — copy or download them and keep them somewhere safe (a password manager is ideal). They're shown once, and they're the only way back in if you lose your phone. Tick to confirm you've saved them, then turn two-factor on.
NoteTurning 2FA on signs you out on your other devices — sign back in with the new second step. From then on, signing in is your password plus a 6-digit code (a recovery code works too).
If you lose your authenticator
Use one of your recovery codes in place of the app code — each works once. Once you're back in, turn two-factor off and on again to get a fresh set of ten.
NoteThere's no support back door: keeping your recovery codes somewhere you'll still have access to is what gets you in if you lose your phone. Treat them like keys.
Turning it off
In Account & security you can switch two-factor off — it asks for your password and a current code (from your app or a recovery code) to confirm it's really you.
Require it for your team (owners)
Owners can require two-factor for everyone under Settings → Security. Turn on your own first, then flip the requirement on — anyone without it is emailed a setup link and gets seven days' grace, after which they'll need to set it up before they can keep using the console.
Changing your login email
Also under Account & security. Enter the new address and confirm with your password (plus a code, if 2FA is on). To keep it safe we email a confirmation link to both your old and new address — click the link in both within 24 hours and the change takes effect (and signs out your other devices).