Two-step verification protects your portal sign-in: after your password, you enter a 6-digit code from an app on your phone. Your agency may require it.
Turn it on
- Sign in to your portal and click Security at the top.
- Click Turn on two-step verification, then Start setup.
- Scan the QR code with an authenticator app on your phone (for example Google Authenticator, Microsoft Authenticator or 1Password), or type the key shown under it.
- Enter the 6-digit code the app shows and click Turn on.
- Save the 10 recovery codes you're shown. They're shown once. Tick I've saved my recovery codes somewhere safe and click Done.
Signing in
After your password, enter the code from your app and click Verify. Tick Remember this device for 30 days on a device only you use and it won't ask again there for 30 days.
This also applies when you open the website editor and when you allow an AI assistant to connect to your sites.
When your agency requires it
After you sign in you'll see Set up two-step verification. If your agency gave you time, Skip for now works until the date shown. After that you need to set it up to use the portal.
Lost your phone
On Enter your code, click Lost your phone? Use a recovery code, type one of your codes and click Use recovery code. Your old app is removed and you set up a new one straight away. Each code works once.
No codes left? Contact your agency. They can reset it for you, and you'll get an email when they do.
Manage it
On Security you can Replace app (new phone), Make new codes, see your Remembered devices and Forget them, and Turn off two-step verification (not while your agency requires it). Turning off and making new codes ask for a code from your app first.
Emails you'll get
You get an email from your agency when two-step verification is turned on or off, when a new device is remembered, when a recovery code is used, and when your agency resets it. They come in your agency's branding and never include a password or a code.
For agencies
Set the rule for all clients on Settings → Olympus → Two-step verification for client portals, or for one client on its Client Access tab. The same tab shows who has it on and has Reset 2FA. See Two-step verification (2FA).
Limits and what it can't do
- Authenticator apps only. Text-message and email codes aren't available.
- If you also sign in to another agency's portal with the same email, your agency can't reset it for you. Use a recovery code.
- View as Client never shows or changes a person's two-step verification.
Troubleshooting
- "That code didn't work": make sure your phone's time is set automatically and use the newest code.
- "Two-step verification is required for your account, so it can't be turned off": your agency requires it. Use Replace app for a new phone.
- Asked for a code on a remembered device: the 30 days ran out, the device was forgotten, your cookies were cleared, or your agency reset it.