Skip to main content
Two-factor authentication (2FA) adds a second step to sign-in: after your password (or Google sign-in), you enter a 6-digit code from an authenticator app on your phone. Anyone who learns your password still cannot get into your account without that code. 2FA is available on all plans.

​
Turn on 2FA for your account

You need an authenticator app such as Google Authenticator, Microsoft Authenticator, 1Password or Authy.
1

Open your account settings

Open the user menu with your avatar and choose Manage account, then scroll to Two-factor authentication.
2

Start the setup

Optionally give the device a name (for example “iPhone”), then click Set up authenticator app.
3

Scan the QR code

Scan the QR code with your authenticator app. If you can’t scan it, enter the key shown next to the code manually.
4

Confirm with a code

Enter the 6-digit code your app shows and click Activate.
From now on, every sign-in asks for a code from your authenticator app.
Add a second device (for example a tablet or a password manager) with Add another device. If you lose your phone, you can still sign in with the other one.

​
Signing in with 2FA

  1. Sign in with your email and password, or with Google, as usual.
  2. Enter the 6-digit code from your authenticator app.
If the code is rejected, check that the time on your phone is set automatically — authenticator codes depend on an accurate clock.

​
Require 2FA for your organisation

Owners and admins can require every member of the organisation to use 2FA.
1

Turn on 2FA for yourself first

You can only require 2FA while you are signed in with 2FA yourself. This prevents you from locking yourself out.
2

Check who is affected

The Members page shows a 2FA status for every member. Members without 2FA will be asked to set it up on their next visit.
3

Turn on the requirement

Go to Organisation Settings → General and switch on Require two-factor authentication. While it is on, the setting shows how many members still have to set up 2FA.
Once the requirement is on:
  • Members without 2FA are sent to the 2FA setup on their next visit and cannot open the organisation until they finish it.
  • Members with 2FA must sign in with a code before they can see any of the organisation’s agents, conversations or leads.
  • Members cannot remove their last authenticator while they belong to an organisation that requires 2FA.
The requirement is enforced by the database itself, not only by the app. A session without the second factor cannot read or change the organisation’s data through any route.
API keys, Zapier, webhooks and your website widget are not affected — they don’t sign in as a user.

​
Remove an authenticator

In Account Settings → Two-factor authentication, click Remove next to the device. Removing your only authenticator turns 2FA off for your account.

​
Lost your authenticator?

If you no longer have access to any of your authenticators, contact our support team. After verifying your identity, we remove your authenticators so you can sign in with your password and set up 2FA again.