Set up two-step verification (MFA)

Two-step verification means signing in takes your password and a six-digit code from an authenticator app on your phone. It is required for owner accounts: an owner who hasn't set it up is taken to the setup page before the rest of the app opens.

Setting it up

1. On the security setup page, enter your current password and choose “Set up authenticator”.
2. Open an authenticator app — Google Authenticator, Microsoft Authenticator, 1Password, Authy or another — and choose “Scan a QR code”. If you can't scan it, choose manual setup in your app and enter the secret shown under the QR code.
3. Save your recovery codes somewhere safe, such as a password manager. They are shown only once.
4. Tick “I have saved these recovery codes in a safe place.”, enter the six-digit code your app shows, and choose “Finish MFA setup”.

Why the recovery codes matter

Each recovery code works once, in place of an authenticator code, if your phone is lost or unavailable. Without them, getting back in means contacting Spanstead support and confirming who you are.

Moving to a new phone

While you're still signed in, open the security setup page and choose “Replace authenticator and recovery codes”. That replaces both, so save the new codes and remove the old entry from your old phone.