How do I set up two-factor authentication?

Protect your account with an authenticator-app code at sign-in, plus recovery codes for when you lose your phone.

You switch on two-factor authentication (2FA) from your account's Sign-in & security page — after that, signing in needs your password plus a 6-digit code from an authenticator app.

Any dashboard user with an email-and-password account can do this. Staff who sign in with a PIN on the portal don't use 2FA — it protects password sign-ins. Your email address must be verified first.

• Open Account → Sign-in & security (from your profile menu), expand Sign-in & authentication, and click Enable 2FA on the Two-factor authentication row.
• In the pop-up, follow step 1. Scan this QR code with Google Authenticator, 1Password, Authy or any similar app — or type the secret shown below the code into the app manually.
• Under 2. Enter the 6-digit code from the app, type the code your app shows and click Verify & enable. If your sign-in is a bit old, you'll be asked to confirm it first ("needs a fresh sign-in confirmation").
• Save your recovery codes. Eight single-use codes appear once 2FA is on — store them somewhere safe (a password manager is ideal). Each one can sign you in exactly once if you don't have your authenticator app.

Signing in with 2FA on. After your password (or Google sign-in), you're asked for the 6-digit code. No phone to hand? Click Use a recovery code instead and enter one of your saved codes — remember each works only once.

Managing it later. On the same row you can Disable 2FA, and a Recovery codes row lets you Regenerate a fresh set (you'll confirm your sign-in; old codes stop working immediately). Regenerate as soon as you've used a few or suspect they've been seen.

Locked out completely? If you've lost both the app and your recovery codes, contact support from the sign-in screen's recovery prompt to regain access — nobody at your restaurant can bypass 2FA for you.

One heads-up: some actions elsewhere in ResoFlow ask you to re-confirm your identity; with 2FA on, those prompts include your authenticator code too.

Related: How do I see and end active sessions? · Can't sign in — password resets and account recovery