Turn on two-step verification

Two-step verification asks for a six-digit code from an authenticator app, as well as your password. A leaked password is then not enough to sign in as you. You can turn it on today on the web, on the iPhone and on Android.

Before you start: Your email address must be verified. Without that, the buttons on Your account stay off and the page says to verify your email first. An account that signs in with a phone number alone cannot add a second step on the phones.

Turn it on in the web console

1. Open Your account from the account menu.
2. In Two-step sign-in, select Add an authenticator app. If asked, confirm it's you first.
3. In Google Authenticator, 1Password, Authy or any authenticator app, add an account and scan the QR code. If you cannot scan it, open Can't scan it? and select Copy key.
4. Type the 6-digit code the app shows and select Turn on.
5. Select Sign in again now. The next time you sign in, we ask for a code.

Turn it on in the phone apps

1. Open Account. Find Two-step sign-in.
2. Select Add a second factor, then Authenticator app.
3. Add the key to your authenticator app. The app shows Open in authenticator app and Copy key.
4. Type the 6-digit code and select Turn on.

Add a second step as a backup

There are no recovery codes. If you lose your phone and have no other step, you cannot get past the code. So add a second step while you can. A text-message step is offered only when BillingMart has switched text-message codes on. On the web the button is Add a phone. On the phones it is Text message under Add a second factor. If you do not see it, your app is the only step.

If you are locked out, write to support@billingmart.com. BillingMart can reset the second steps on an account. A reset signs you out everywhere, and you add a new step afterwards.

When you are asked for the code

• At sign-in. After your password or Google, a Second factor box asks for the code. If you have more than one step, Use another method lets you choose.
• When you confirm something sensitive. The Confirm it's you window asks for your password and then your code.

When a second step is required

Whether a missing second step is refused is a policy BillingMart controls, with a start date.

• Before the date, or while none is set. You are let through without a second step. BillingMart notes that you would be refused later. Once a date is set, a banner on the web says Two-step sign-in is coming and shows it.
• After the date. The action is refused until you add a step. A Turn on two-step sign-in window walks you through it, and the action then goes ahead.

After the date, these always need a second step: refunds and voids, credit notes, write-offs, voiding an invoice, switching autopay on for a recurring invoice, creating or revoking an API key, scheduling a workspace for deletion, and removing a second step. Many other sensitive changes need one too, such as team changes, webhooks, payment setup, messaging settings and plan changes. For those, BillingMart can exempt a phone app or a trusted Google Workspace domain, so what you are asked can differ between apps. Approving an Agent or assistant request that moves money or changes settings always needs a second step. See Approve requests on your phone and Refund or void a payment.

An owner can also require a second step for owners and admins under Settings, then Security. The switch covers live payment setup, API keys, app connections, team invitations and some other sensitive changes.

Remove a second step

On Your account, select Remove beside the step, then confirm. You are asked to confirm it's you first. Removing a step ends every session you have, on every device, so you sign in again. If it was your last step, the next sensitive action asks you to add one.

If you pay bills as a customer

Customers have their own Security page in the portal. It offers an authenticator app only, not text messages. Paying with a saved card, autopay and removing a saved card fall under the same policy date.