Turn on two-factor authentication with an authenticator app, sign in with the verification step, turn it off, and what to do if you lose your device.
Two-factor authentication adds a second step to signing in: after your password (or Google or Facebook), you enter a 6-digit code from an authenticator app on your phone. Someone who learns your password still can't get in without your phone.
It's set per person, for your own account, in Settings > Security > Two-factor authentication. Any member can turn it on, whatever their role.
An authenticator app - Google Authenticator, Authy, 1Password, and similar apps all work. Each one shows a new 6-digit code roughly every 30 seconds.
Click Enable
On the Two-factor authentication card ("Add a second step at sign-in using an authenticator app"). A QR code appears.
Add Avox to your authenticator app
Scan the QR code with the app. If you can't scan it, use the key under "Can't scan? Enter this key manually:" - the copy button next to it copies it for you.
Enter the code
Type the 6-digit code the app shows and click Verify.
Done
You see "Two-factor authentication is on", the card shows On - "an authenticator app code is required at sign-in", and you get a "Two-factor authentication is on for your Avox account" email.
Changed your mind halfway? Click Cancel - nothing is turned on.
Errors: AVX-3088 (setup couldn't start), AVX-3089 (the code didn't work - codes only last about 30 seconds, so check your phone's clock is right and try the next one).
Sign in as usual
With your password, a passkey, Google, or Facebook.
The verification step
The sign-in card changes to Two-factor authentication - "Enter the 6-digit code from your authenticator app to finish signing in."
Enter the code
Type the 6 digits from your app. The code is checked as soon as the last digit is in - there's nothing to click. You go straight on to your dashboard (or the page you were opening).
If you open a dashboard link before finishing this step, the dashboard shows the same verification step first. Until the code is entered, every page sends you back to it, and your account stays closed - a password on its own opens nothing. Once you're through, you stay signed in for the usual length of a session.
Forgot password? asks for the code from your authenticator app too, after the code we email you and before you choose a new password. An emailed code alone can't change the password of a two-factor account.
Click Disable on the card. Because you're already signed in with both steps, no extra code is needed. You see "Two-factor authentication is off" and get a "Two-factor authentication was turned off" email - if you didn't do it, change your password straight away and reply to that email. If turning it off fails, you see AVX-3090.
Two-factor uses one authenticator at a time. To move to a new phone while you still have the old one:
Many authenticator apps can also move their accounts to a new phone themselves - check your app's own settings.
The verification step needs a code from your authenticator app. If you can't get one:
Before you change or reset your phone, turn two-factor off and on again with the new phone (see Changing phones), so you're never left without a code.
Last updated