Team and Security
Two-factor and passkeys
Protect your login with a time-based code from an authenticator app, keep recovery codes safe, and sign in without a password using a passkey.
A password alone can be guessed, reused or phished. Two-factor authentication (2FA) adds a second step: after your password, you enter a six-digit code from an authenticator app on your phone. Passkeys go further and replace the password altogether with a key stored on your device. Both are free on every plan and set up in Settings > Security.
Which should I use?
| Two-factor (TOTP) | Passkey | |
|---|---|---|
| What it is | A code that changes every 30 seconds, from an authenticator app | A cryptographic key on your phone, computer or security key, unlocked with your fingerprint, face or device PIN |
| How it signs you in | Password (or another method) plus the code | On its own, with no password |
| Protects against | Stolen or guessed passwords | Stolen passwords and phishing sites, because a passkey only works on our real domain |
| Works with | Any standard authenticator app | Devices and browsers that support passkeys (WebAuthn) |
Many people use both: a passkey for everyday sign-in on their own devices, and a password with two-factor as a backup.
Two-factor is optional for your login. It is always required for our own staff console, which you never see.
Turn on two-factor
Open Settings > Security
Because changing two-factor settings is a sensitive action, you may be asked to sign in again first.
Choose to turn on two-factor
A QR code appears.
Scan the QR code with your authenticator app
The app adds an entry for Free Invoice Automation and starts showing six-digit codes. If you cannot scan, the screen also shows the setup key to type in.
Enter the current code to confirm
This proves the app is set up correctly. Two-factor is not switched on until this step succeeds.
Save your recovery codes
You get a set of one-time recovery codes. Store them somewhere safe and separate from your phone, such as a password manager. Each code works once.
From then on, every sign-in asks for a code from the app after your first step. The change is written to your audit log.
Recovery codes
Recovery codes are your way back in if you lose your phone. Each one can be used once in place of an authenticator code. We store them only as hashes, so we cannot show them to you again. Save them the moment they appear.
Turn off two-factor
Open Settings > Security and turn two-factor off. This needs a fresh sign-in, and the change is audited. We recommend keeping it on, especially if you are the Owner of an account with members or connected payment methods.
Add a passkey
You add a passkey while signed in, then use it next time.
Open Settings > Security
Choose to add a passkey.
Follow your device's prompt
Your browser or operating system asks you to confirm with your fingerprint, face, device PIN or a security key. The private key never leaves your device; we only store its public half.
Name it
Give the passkey a name you will recognise, such as "Work laptop", so you can tell your passkeys apart later.
Next time, choose to sign in with a passkey on the sign-in page and confirm on your device. You are signed in with no password. You can add several passkeys, for example one per device, and remove any of them from Settings > Security.
Good practice
- Turn on two-factor or use a passkey if you are the Owner, or if your role can move money (record payments, refunds, auto-charge) or manage the team.
- Keep recovery codes offline or in a password manager, never in the same place as your authenticator.
- Remove passkeys for devices you no longer use.
- Use Sign out everywhere in Settings > Security if you think someone else has used your session.
- Remember that API keys are separate from your login. Two-factor protects the web app and MCP sign-in; API keys are protected by keeping them secret, giving them narrow scopes and revoking them when no longer needed. See Authentication.
If you lose access
| Situation | What to do |
|---|---|
| New phone, old phone still works | Sign in, turn two-factor off and on again with the new phone. |
| Phone lost, recovery codes available | Sign in with a recovery code, then turn two-factor off and on again with your new phone. You get a new set of recovery codes. |
| Passkey device lost | Sign in with another method (another passkey, password and two-factor, or a magic link) and remove the lost passkey. |
| Everything lost | Contact support from the email address on your login. We verify that the request really comes from you before changing anything. |
Through the API
Two-factor and passkeys are settings of your personal login, not of an account, so they are managed only in the web app. There is no API endpoint for them, and an API key cannot change them. The API returns fresh_signin_required for actions that need a recent sign-in, and those must be done in the web app.
Plans and permissions
- Available on Free and Team, at no cost.
- No permission key is needed: two-factor and passkeys belong to your personal login, so every person manages their own.