Two-factor sign-in and passkeys
Protect your login with a passkey or an authenticator app, keep recovery codes, require two-factor for your whole team, and recover when you lose a device.
Your phone system holds call recordings, messages and customer details. A second sign-in step keeps someone with your password out.
Your own security settings
Open your avatar menu (top right) and choose Security. That page has:
- Password: press Email me a reset link to set a new one.
- Authenticator app: a 6-digit code from an app on your phone.
- Passkeys: sign in with your fingerprint, face or screen lock instead of a password.
- Trusted devices: computers you've told to ask less often.
- Where you're signed in: every browser and tool with a live session. Sign one out from here.
Add a passkey (recommended)
A passkey is the easiest choice. You sign in with your fingerprint, face or screen lock, with nothing to type. It also counts as your second step.
- On the Security page, press Add a passkey.
- Name it, like "Work laptop", so you can tell your passkeys apart.
- Confirm your password.
- Follow your device's prompt (fingerprint, face, screen lock or a security key).
Next time, press Sign in with a passkey on the sign-in page. Many password managers sync a passkey to all your devices. Add one on each computer you use if yours doesn't.
Turn on an authenticator app
- On the Security page, under Authenticator app, press Turn on.
- Confirm your password.
- Scan the code with an authenticator app (1Password, Google Authenticator, Authy, Microsoft Authenticator or similar), or type the setup key.
- Type the 6-digit code the app shows.
- Save your recovery codes somewhere safe, then press I saved these codes.
When you sign in, you'll be asked for the code. Tick Trust this device for 30 days on a computer only you use, and it won't ask every time.
Recovery codes
Each recovery code works once, in place of a code from your app. Keep them somewhere other than your phone. If you're running low, press New recovery codes. Your old ones stop working.
Require two-factor for your team
Admins set this in Settings → Sign-in security, under Two-factor policy:
- Off: each person decides.
- Required: everyone must use a passkey or an authenticator app. They can trust a computer for 30 days so it asks less often.
- Strict: for healthcare and other sensitive work. Two-factor at sign-in, again every 12 hours, and a fresh check before playing recordings or voicemail, reading transcripts, exporting, revealing a SIP password or creating an API key. Trusted computers don't count.
When you turn it on, people without two-factor see a banner with a deadline and a Set it up now link. At their next sign-in after that, they're asked to set it up before they can continue: Create a passkey or Use an authenticator app.
The Members list on the same page shows who has set it up and when they last checked in.
Lost your phone or passkey?
- Have a recovery code? Use it at sign-in where it asks for your code. Then turn the authenticator off and on again with your new phone.
- Have another passkey or device? Sign in with that, then remove the lost one from Passkeys.
- Neither? Ask an admin of your organization. In Settings → Sign-in security, they find you in the Members list and reset your two-factor. You're signed out everywhere and set it up again at your next sign-in.
- You're the only owner and admin? Contact support. We verify who you are before we reset anything.
Also see I can't sign in.
Was this helpful?