Two-factor sign-in asks for a six-digit code from an authenticator app on your phone every time you sign in, after your password or emailed link. Someone who learns your password, or gets into your email, still cannot sign in as you without your phone.
Turning it on
Open your Account page and choose Set up two-factor.
- If your account has a password, confirm it.
- Install an authenticator app if you do not have one. Google Authenticator, Microsoft Authenticator and 1Password all work.
- Scan the QR code with the app, or type in the key shown under it.
- Enter the six-digit code the app shows, and choose Turn on two-factor.
You are then shown ten backup codes. Copy them or download them and keep them somewhere safe, such as a password manager. They are shown once.
Signing in with it on
Sign in as you normally do, with your password, an emailed link or Xero. You are then asked for the code your authenticator app is showing. The code changes every 30 seconds; enter the one on screen.
There is no option to remember a device, and codes are never sent by email: every sign-in asks for the code from your phone.
If you do not have your phone
On the code step, choose Use a backup code and enter one of your backup codes. Each one works once. If you are running low, choose New backup codes on your Account page: you get a fresh set of ten and the old ones stop working.
If you have lost both your phone and your backup codes, contact support. Once we are sure the request is yours, we can reset your two-factor sign-in. That signs you out everywhere; you then sign in again and set it up with a new authenticator.
When it is required
An organization connected to MYOB requires two-factor sign-in of everyone in it, because MYOB holds its accounting records. If you are a member of one and have not set it up, opening the organization takes you to set it up first, and back to where you were going afterwards. You cannot turn it off while you are a member of such an organization, and the requirement stays in place if the organization later disconnects MYOB.
Anywhere else, two-factor sign-in is your choice, and you can turn it off from your Account page.