Two-factor and passkey sign-in
Strengthen sign-in with two-factor authentication, passkeys and session controls.
Protect access to your business records with two-factor sign-in and optional passwordless passkeys. Review recorded sign-in sessions and revoke ones you do not recognise. Sensitive money and access-management actions require fresh verification.
Sign in without a password
- Register a passkey and unlock it with your fingerprint, face or device PIN. Its credential is bound to the site, helping resist phishing.
- A passkey can also be used as a phishing-resistant second factor. Keep the device and its recovery options secure.
- Prefer codes? Use any authenticator app for standard six-digit two-factor.
Protection on the actions that matter
- Money and admin actions ask you to confirm it is really you, even mid-session.
- Review recorded sign-in sessions and revoke access for sessions you do not recognise.
- Changing your sign-in email is confirmed from both the old and the new address.
Set the bar for the whole team
- An owner can require every team member to use two-factor sign-in, not just themselves.
- Assign roles and permissions to control which screens and actions each person can access.
- The security page shows recent recorded audit entries, with a link to review more audit history.
Common questions
- What is a passkey?
- A sign-in method built into your phone or laptop that uses your fingerprint, face or device PIN instead of typing a password. The credential is bound to the site it was registered for, which helps resist phishing. Keep your device and its recovery options secure.
- Can I make two-factor compulsory for my crew?
- Yes. An owner can turn on a business-wide requirement so every team member has to set up two-factor sign-in.
- What if I lose the phone with my authenticator on it?
- Register more than one method - a passkey on your laptop as well as codes on your phone, for example - so you have another registered sign-in option if one device is unavailable.
- Why does it ask me to confirm again when I am already signed in?
- Sensitive money and access-management actions require fresh verification. This adds a check when a session is already open; it does not replace locking your device or protecting your sign-in and recovery methods.