Two-factor authentication asks for a code from an app on your phone when you sign in, so a stolen password alone can't open your business. Turn it on under Settings → Just you → Profile: scan a QR code, confirm a 6-digit code, and save the recovery codes you're shown once.
Before you start
- Install an authenticator app, such as Google Authenticator, Authy, 1Password or Microsoft Authenticator.
- Who can do it: everyone, for their own account.
Turn on two-factor authentication
Open your profile settings
Go to Settings → Just you → Profile. Under Security, on the Two-factor authentication (2FA) row, select Enable 2FA.
Scan the QR code
Scan it with your authenticator app. Can't scan? Type the setup key shown beside the QR code into the app instead.
Confirm with a code
Enter the 6-digit code the app now shows and select Verify & Enable.
Save your recovery codes
Owneli immediately generates single-use recovery codes and shows them once. Copy or download them into a password manager. When you close the dialog, they can't be viewed again.
What changes at sign-in
After your email and password (or magic link), you're asked for the current 6-digit code from your authenticator app. Enter it and you're in.
What if I lose my phone?
Use one of your recovery codes:
Sign in as usual
Enter your email and password (or use a magic link). When you're asked for the 6-digit code, choose Use a recovery code instead.
Enter a recovery code
Type one of your saved codes, with or without the dash. Each code works once.
Set two-factor up again
The code turns two-factor off for your account and signs you out of every other device, so a lost phone can't be used to get back in. If your business requires two-factor, you're taken straight to set it up again; otherwise you'll see a reminder to do it. Either way, set it up again and save the new codes.
We email you whenever a recovery code is used. If you didn't use one, change your password and contact your business's administrator.
After five wrong codes you'll need to wait 15 minutes before trying again.
Lost your recovery codes too?
- Team members: ask an admin of your business to reset your two-factor (see below). You can then sign in with your password and set it up again.
- The business owner: nobody inside the business can reset the owner's two-factor. Use a recovery code, or contact Owneli support, who will verify it's really you before doing anything.
From Settings → Just you → Profile you can always see how many codes remain, with a warning when only a few are left, and regenerate a fresh set. Regenerating invalidates every code from the previous batch.
Resetting a team member's two-factor
For someone who has lost their phone and their recovery codes.
Open their profile
Go to Team, open the team member, and choose the Offboarding tab.
Reset two-factor
In the Two-factor authentication card, choose Reset two-factor and confirm.
This removes their authenticator and recovery codes, signs them out of every device, emails them, and adds an entry to your audit log. It applies to their whole Owneli login, so if they also work for another business, their two-factor is off there too until they set it up again.
Who can do it: anyone with permission to manage the team, with two-factor turned on for their own account and used at this sign-in. You can't reset:
- the owner's two-factor (the owner uses a recovery code or contacts Owneli support),
- your own (use a recovery code when you sign in),
- someone whose role is above yours (for example, a manager can't reset an admin).
Requiring it for the whole team
| Action | Who can do it | Where |
|---|---|---|
| Turn it on for yourself | Everyone | Settings → Just you → Profile |
| See who has it on | Admins | Settings → Team & access → Security & AI |
| Require it for everyone | Owner only | Settings → Team & access → Security & AI |
| Reset a team member's two-factor | People who manage the team (not the owner's, not your own) | Team → member → Offboarding |
Once enforced, everyone is prompted to enrol at sign-in. Admins can use the roster to chase stragglers before flipping enforcement on.
Check it worked
The two-factor row shows it's on, and the next time you sign in you're asked for a code from your app.
If something goes wrong
Why am I asked to set up two-factor after signing in?
Owners and admins who have not enrolled may see an optional setup reminder. Not now pauses that reminder for seven days for your account in this browser. Don't remind me dismisses the optional reminder for that account in this browser. Clearing browser storage or using a different device can make it appear again.
These choices do not disable two-factor authentication or override your business's requirement to use it. You can still turn it on at any time in Settings → Just you → Profile.
Which authenticator apps work?
Any app that makes six-digit codes (TOTP), such as Google Authenticator, Authy, 1Password or Microsoft Authenticator.
How do I turn two-factor off?
Under Settings → Just you → Profile, select Disable 2FA on the two-factor row. If your business requires it, expect to be prompted to enrol again.
Are recovery codes shown again later?
No. They're displayed exactly once when generated. If you didn't save them, regenerate a new set; the old ones stop working.
Can Owneli support turn off my two-factor?
Only after verifying it's really you, which includes calling you back on the details we already hold, and never on the first call. Owneli support will never ask for your password, a sign-in code or a recovery code.