Two-factor authentication

Updated Oct 20, 20264 min read

English

On this page

Two-factor auth (2FA) adds a second sign-in step using an authenticator app, on top of your password. Even if your password leaks, attackers can't log in without the 6-digit code from your app. Setup is a 1-minute QR-scan flow with any TOTP app (Google Authenticator, Authy, 1Password, Microsoft Authenticator). Strongly recommended for everyone, especially administrators.

What Is Two-Factor Authentication?

Two-factor authentication (2FA) adds an extra layer of security to your Deskwoot account by requiring a second form of verification in addition to your password. Even if someone obtains your password, they won't be able to access your account without the unique, time-sensitive code generated by your authenticator app. Enabling 2FA is one of the most effective steps you can take to protect your account and your customers' data.

Enabling 2FA

Follow these steps to turn on two-factor authentication for your Deskwoot account:

Log in to your Deskwoot account.
Navigate to Settings > Security.
Click Enable 2FA.
Open your preferred authenticator app (such as Google Authenticator, Authy, or Microsoft Authenticator) on your mobile device.
Scan the QR code displayed on screen with your authenticator app.
Enter the 6-digit code generated by the app and click Verify & Enable.
Store the 8 recovery codes in a safe location. They are shown only once. You will need them if you lose access to your authenticator app.

Best-Practice Tips

Save your recovery codes: Write them down or store them in a secure password manager. These codes are your safety net if your device is lost, stolen, or reset.
Use a dedicated authenticator app. Deskwoot does not send codes by SMS, and app-based codes are more resistant to interception anyway.
Encourage your entire team to enable 2FA, especially agents and administrators with access to sensitive customer information.
Keep your authenticator app updated to ensure compatibility and receive the latest security patches.

Troubleshooting

Verification code not working

Authenticator codes are time-sensitive. Make sure the clock on your mobile device is set to automatic or synced accurately. Even a small time drift can cause codes to be rejected.

Lost access to your authenticator app

Use one of the backup/recovery codes you saved during setup to log in. Once logged in, disable 2FA and re-enable it with your new device or app. If you no longer have your recovery codes, contact Deskwoot support. Workspace administrators cannot reset another member's 2FA.

Frequently asked questions

Which authenticator apps work?

Any standard TOTP app: Google Authenticator, Authy, 1Password, Microsoft Authenticator, Bitwarden. They're all interchangeable: TOTP is a standard.

What if I lose my phone?

Use one of the recovery codes you saved during setup to log in. Then disable 2FA and re-enable with your new device. If you also lost the recovery codes, contact Deskwoot support. Workspace administrators cannot reset another member's 2FA.

Should I use SMS-based 2FA or app-based?

App-based. SMS can be intercepted (SIM-swap attacks) and we don't offer SMS as a 2FA channel. App-based TOTP is the standard and more secure option.

Can I enforce 2FA for everyone on my account?

Yes, on the Enterprise plan; by default 2FA is optional. An administrator turns on Require two-factor authentication for all members under Settings → Account Settings. Members without 2FA are sent to their security settings on their next visit and can only continue to the dashboard after setting it up. Each member still enables 2FA on their own account in Settings → Security.

What if the 6-digit code doesn't work?

Most common cause: your phone's clock is off. TOTP codes are time-based; even 30 seconds drift breaks them. Set your phone to auto-sync time. If still failing, use a recovery code and re-pair the authenticator.

How many recovery codes do I get?

8 single-use recovery codes, shown once at setup time. Each one works once and is invalidated after use. Save them in a password manager so a lost phone doesn't lock you out: regenerating by re-enabling 2FA is the only path back if you lose both.

Will I have to enter the code every login?

Yes. We don't ship a 'trust this device for X days' option today: the trade-off favours security on a tool that holds customer data. If session-length friction is a problem, raise it with support.

Can I have multiple authenticator devices?

Yes. Scan the QR code with multiple devices during setup (e.g. phone + 1Password vault on laptop). Both generate valid codes; useful if you frequently switch devices or want a backup secret-holder.

Does 2FA work with the mobile app?

Yes. On first login from the mobile app, you enter your password + the 6-digit code, same as web. After that, the mobile app uses a long-lived token; you don't re-enter on every app open.

Does an API token bypass 2FA?

Yes by design: API tokens authenticate machine-to-machine traffic and aren't gated by the user's 2FA. Best practice: scope tokens narrowly and rotate regularly, since they don't get the second-factor protection.

What if I want to disable 2FA?

Settings → Security → Disable 2FA. You verify with your password first so someone with access to your unlocked session can't quietly remove the protection. If your workspace requires 2FA for all members, you are sent straight back to set it up again.

Was this guide helpful?

Keep reading

Ask Fynn about this guide

Get a short answer from this guide and the rest of the help center.