Skip to main content
Two-factor authentication (2FA) requires a one-time code from an authenticator app each time you sign in with your email and password. Bizzy uses TOTP (time-based one-time passwords), the same standard used by Google Authenticator, 1Password, Authy, and most other authenticator apps.

​
Prerequisites

  • A signed-in Bizzy account with email-and-password sign-in — the Two-factor authentication card only appears for these accounts, and your password is required to enable 2FA
  • An authenticator app installed on your phone or password manager

​
Enable two-factor authentication

  1. Navigate to Settings > User > Security
  2. In the Two-factor authentication card, click Enable two-factor authentication
  3. Enter your current password to confirm
  4. Scan the displayed QR code with your authenticator app — or enter the secret manually if you can’t scan
  5. Enter the 6-digit code your app generates to verify the setup
  6. Save the backup codes displayed on the next screen, then click Done
Backup codes are shown only once. Save them in a password manager or other secure location before clicking Done. You’ll need them if you ever lose access to your authenticator app.

​
Backup codes

Each backup code can be used once in place of a TOTP code. Use them when you don’t have your authenticator app — for example, after losing or wiping a phone. To generate a fresh set:
  1. In the Two-factor authentication card, click Regenerate backup codes
  2. Enter your current password
  3. Save the new codes — the previous set is invalidated immediately

​
Sign in with two-factor authentication

When 2FA is enabled, sign-in requires two steps:
  1. Enter your email and password
  2. Enter the 6-digit code from your authenticator app (or a one-time backup code)
You’re prompted on every new session — existing sessions stay valid until they expire normally. Signing in with Google, Microsoft, or a passkey never asks for a code.

​
Too many wrong codes

Five wrong codes in a row end the sign-in attempt — start again from your email and password. Ten wrong codes in a row, counted across attempts and across both authenticator and backup codes, block sign-in for 15 minutes. A correct code resets the count.

​
Disable two-factor authentication

  1. Navigate to Settings > User > Security
  2. In the Two-factor authentication card, click Disable 2FA
  3. Enter your current password to confirm
Disabling clears your TOTP secret and all unused backup codes.

​
Limitations

  • Password sign-in only. 2FA protects sign-in with your email and password. An account with no password — one that signs in only through Google, Microsoft, or a passkey — can’t enable it
  • Self-serve only. 2FA is per-user; Bizzy does not yet support business-wide 2FA enforcement
  • Active sessions list not yet available. You can’t currently view or revoke individual signed-in sessions from the security settings page — clearing browser cookies or changing your password ends all sessions

​
Recovering a locked-out account

If you’ve lost access to both your authenticator app and your backup codes, contact support — there is no self-serve path to disable 2FA without one of those factors.

​
Next steps

Passkeys

Sign in with biometrics or a hardware key

API keys

Programmatic access for integrations
Last modified on September 11, 2026