Two-step sign-in (also called two-factor authentication or 2FA) asks for a 6-digit code from an authenticator app on your phone each time you sign in, after your password.

Who needs it

Company admins must use 2FA: an admin without it is asked to set it up before using Demurly. (People who sign in through your company's single sign-on don't need it.) Team members can turn it on any time, and need it to:

Invite customers, carriers or team members
Export data: Export CSV on Records, Payments and Payouts, the Reports downloads, saved reports, Settings > Data & exports, scheduled exports and the audit log
Set up payouts and open your payout account (carriers)
Manage API keys, webhooks and single sign-on

Turning it on is what counts: you enter the code when you sign in, not again for each of these.

Turn it on

Go to Settings > Sign-in & security (or click Turn on 2FA in the banner on your dashboard).
Click Turn on 2FA and scan the QR code with Google Authenticator, Authy, 1Password or a similar app. Can't scan? Type the key shown under the code.
Enter the 6-digit code from the app and click Verify and turn on 2FA.
Save your 10 recovery codes: copy or download them, tick "I've saved these codes" and click Done. They're shown once.

Settings > Sign-in & security shows how many recovery codes you have left and warns when you're running low. Click Create new codes to replace the whole set (the old ones stop working).

Lost your phone?

Sign in with your password, then click "Lost your authenticator? Use a recovery code" and enter one of your codes. Each code works once and signs you in for that session; 2FA stays on.
Go to Settings > Sign-in & security and click Set up a new authenticator. Scan the new QR code with your new phone and click Replace authenticator. The old phone's codes stop working.
Then create a new set of recovery codes. (Creating codes or turning 2FA off needs a code from the authenticator app, not a recovery code.)

No recovery codes either? Email support@demurly.com from your account's email address. We confirm it's you before we reset 2FA for your account; then you set it up again and save new recovery codes.