Account Security
Two-factor sign-in for everyone, plus the controls to keep your own account safe.
What it does
Your workspace holds customer conversations and contact details, so every account is protected by two-factor authentication (2FA): your password plus a 6-digit code from an authenticator app on your phone. On top of that you can change your password, remove devices you no longer use, and manage personal API tokens.
Setting up two-factor authentication
Two-factor authentication is required for every user. You may see a banner counting down the days left to set it up; once that time runs out, you are taken to the setup page before you can use the app.
- Install an authenticator app such as Google Authenticator, 1Password or Authy.
- On the Two-factor authentication page, click Enable two-factor authentication.
- Scan the QR code with your app (or enter the setup key by hand).
- Save your Recovery codes somewhere safe, such as a password manager.
- Type the 6-digit code from your app and click Confirm. The status changes to Active.
Signing in
After your password, you are asked for the Authentication code from your app. Enter it and click Verify and continue.
- Lost your phone? Click Use a recovery code instead and enter one of your saved codes. Each code works once, so regenerate a fresh set after signing in.
- Trust this device: if your workspace allows it, you can tick this box on the code screen to skip the code in that browser for a set number of days. Never tick it on a shared or public computer.
Recovery codes and trusted devices
On the Two-factor authentication page you can:
- Regenerate codes to get a new set of recovery codes. Do this whenever you have used one or think they may have been seen.
- See every Trusted device, with when it was last used and when it expires.
- Remove a single device, or Remove all. A removed browser asks for a code again on its next sign-in.
Your profile and password
Open the menu under your name (top right):
| Menu item | What you can change |
|---|---|
| Update Profile | Your name, phone, the email you sign in with, and an About me note for teammates. |
| Change Password | Enter your current password, then the new one twice, and click Update password. |
Changing your password also removes every trusted device, so each browser asks for a 2FA code again.
Personal API tokens
If your plan includes API access and your role allows managing API keys, you can create tokens for your own scripts and testing on the My API tokens page (Setup → API Documentation → Manage API Keys → Manage personal tokens). Two-factor authentication must be set up before you can create one.
- Give the token a Name (e.g. "Zapier integration").
- Choose Full access (read + write) or Read only.
- Optionally set Expires after (days). Leave it blank for a token that does not expire.
- Click Create token and copy it straight away. It is shown only once.
Calls made with a personal token are recorded as you, and the token can only do what your role allows: a role that cannot view customers cannot read them through the API either. The token stops working if your account is deactivated or your plan no longer includes API access. Click Revoke to cut one off immediately. For a shared, long-running integration, use a workspace API key instead (see API Access).
Good to know
- Keep your recovery codes away from your phone. If you lose both, contact support to get back in.
- Remove trusted devices when you change jobs, sell a laptop, or stop using a browser.
- Never share your password or codes. Our team will never ask you for them.
Two minutes setting up 2FA properly, recovery codes included, saves a locked-out morning later.
