# Turn on two-step verification

> Add an authenticator app as a second sign-in step on the web, iPhone or Android, and learn when BillingMart asks for the code.

Source: https://support.billingmart.com/account-and-security/two-step-verification
Updated: 2026-10-17 · Applies to: Web, iPhone, Android · Section: Account & security

Two-step verification asks for a six-digit code from an authenticator app, as well as your password. A leaked password is then not enough to sign in as you. You can turn it on today on the web, on the iPhone and on Android.

> **Before you start:** Your email address must be verified. Without that, the buttons on **Your account** stay off and the page says to verify your email first. An account that signs in with a phone number alone cannot add a second step on the phones.

## Turn it on in the web console

1. Open **Your account** from the account menu.
2. In **Two-step sign-in**, select **Add an authenticator app**. If asked, confirm it's you first.
3. In Google Authenticator, 1Password, Authy or any authenticator app, add an account and scan the QR code. If you cannot scan it, open **Can't scan it?** and select **Copy key**.
4. Type the **6-digit code** the app shows and select **Turn on**.
5. Select **Sign in again now**. The next time you sign in, we ask for a code.

## Turn it on in the phone apps

1. Open **Account**. Find **Two-step sign-in**.
2. Select **Add a second factor**, then **Authenticator app**.
3. Add the key to your authenticator app. The app shows **Open in authenticator app** and **Copy key**.
4. Type the 6-digit code and select **Turn on**.

## Add a second step as a backup

There are no recovery codes. If you lose your phone and have no other step, you cannot get past the code. So add a second step while you can. A text-message step is offered only when BillingMart has switched text-message codes on. On the web the button is **Add a phone**. On the phones it is **Text message** under **Add a second factor**. If you do not see it, your app is the only step.

If you are locked out, write to support@billingmart.com. BillingMart can reset the second steps on an account. A reset signs you out everywhere, and you add a new step afterwards.

## When you are asked for the code

- **At sign-in.** After your password or Google, a **Second factor** box asks for the code. If you have more than one step, **Use another method** lets you choose.
- **When you confirm something sensitive.** The **Confirm it's you** window asks for your password and then your code.

## When a second step is required

Whether a missing second step is refused is a policy BillingMart controls, with a start date.

- **Before the date, or while none is set.** You are let through without a second step. BillingMart notes that you would be refused later. Once a date is set, a banner on the web says **Two-step sign-in is coming** and shows it.
- **After the date.** The action is refused until you add a step. A **Turn on two-step sign-in** window walks you through it, and the action then goes ahead.

After the date, these always need a second step: refunds and voids, credit notes, write-offs, voiding an invoice, switching autopay on for a recurring invoice, creating or revoking an API key, scheduling a workspace for deletion, and removing a second step. Many other sensitive changes need one too, such as team changes, webhooks, payment setup, messaging settings and plan changes. For those, BillingMart can exempt a phone app or a trusted Google Workspace domain, so what you are asked can differ between apps. Approving an Agent or assistant request that moves money or changes settings always needs a second step. See [Approve requests on your phone](https://support.billingmart.com/phone-apps/approve-on-your-phone.md) and [Refund or void a payment](https://support.billingmart.com/payments/refunds-and-voids.md).

An owner can also require a second step for owners and admins under **Settings**, then **Security**. The switch covers live payment setup, API keys, app connections, team invitations and some other sensitive changes.

## Remove a second step

On **Your account**, select **Remove** beside the step, then confirm. You are asked to confirm it's you first. Removing a step ends every session you have, on every device, so you sign in again. If it was your last step, the next sensitive action asks you to add one.

## If you pay bills as a customer

Customers have their own **Security** page in the portal. It offers an authenticator app only, not text messages. Paying with a saved card, autopay and removing a saved card fall under the same policy date.