Two-step verification

Two-step verification protects your account with a second step when you sign in: after the password, Memberfy sends a 6-digit code to your phone on WhatsApp (or by text message), and you only get in with it. Even if someone learns your password, they cannot sign in without the code from your phone.

You don't need an authenticator app and it costs nothing: Memberfy pays for the messages, and the code does not count against the community's text message and WhatsApp quota.

Since the account is one per community, so is the verification: turned on here, it applies to your sign-in in this community.

#What it's for

#How it works

#Who must have it

The team deadline starts the first time the person uses a team screen or action without verification. After the deadline, the team screens and actions are blocked ("The team screens and actions are blocked: turn on two-step verification to continue."), and that person's API keys also stop reaching the team routes. The way to turn it on is always open: My account › Security and the notice's Turn on now button. Once it is on, everything works again right away.

#The default for members

In Settings › Access and sign-up, the Two-step verification for members card has the option Ask members for two-step verification. Only the owner changes it ("Only the owner changes this option.").

• Off (default): each member decides whether to turn theirs on.
• On: members without verification see the invitation "This community asks you to turn on two-step verification to protect your account.", with Turn on now and Not now. Nobody is blocked. Whoever turns it on can no longer turn it off while the option is on.

#Signing in with a code

With verification on, signing in with the right password opens the Two-step verification step:

• "We sent a code on WhatsApp to {phone}.", with the number masked. Type the 6 digits in 6-digit code and tap Sign in.
• Get it by text message sends the code by text message. If WhatsApp doesn't accept the number, the code already goes by text message.
• Remember this device for 90 days: on this browser, the next sign-ins ask only for the password until it expires.
• Use a recovery code: sign in with one of the recovery codes if your phone isn't with you.

A wrong password does not trigger a code. A wrong code shows how many attempts are left; when they run out, ask for a new code. If the code request expires, the screen asks you to sign in with the password again. Connecting an AI assistant goes through the same sign-in and also asks for the code.

#The recovery codes

When you turn it on, the screen shows 10 recovery codes, only once, with Copy and Download. It only finishes after you check I saved the codes somewhere safe. Each code works once, in place of the phone code.

• When you sign in with a recovery code, it stops working, the screen says how many are left and you get an alert e-mail.
• With few codes left, My account › Security warns you. Create new recovery codes replaces all 10: the old ones stop working.

#Remembered devices

In My account › Security, Remembered devices lists the browsers where signing in does not ask for the code, with the browser and system, the last use and how long it is valid. Remove forgets one; Remove all forgets all of them (your current session stays). Changing the password or turning verification off also removes them all.

#The extra step

With verification on, some actions ask for a new code right then, even when you are already signed in: the Confirm it is you window sends the code to your phone and only goes on after it.

After you confirm, the next actions on the list don't ask for another code for a few minutes. In a Memberfy support session (the SuperAdmin's Sign in), these actions are not available: only the person does them, in their own account.

#Security activity

Security activity shows the recent verification events on your account: turned on, turned off, phone changed, device remembered or removed, recovery code used, new codes created and verification reset by support. Turning it on, turning it off, using a recovery code and a reset by support also send you an e-mail.

#Step by step

#Turn verification on

Role: anyone, on their own account.

1. Open My account › Security (/account?tab=security).
2. Under Two-step verification, tap Turn on two-step verification.
3. Enter the Phone (a number with WhatsApp), choose Send the code by WhatsApp or text message and tap Send code.
4. Type the code and tap Turn on. The number becomes your account's confirmed phone.
5. Keep the 10 recovery codes (Copy or Download), check I saved the codes somewhere safe and tap Done.

The section then shows On, the phone, the date, the recovery codes left and the remembered devices. In a country without supported WhatsApp or text messages, you cannot turn it on, and the screen explains why.

#Change the phone

1. In My account › Security, tap Change phone and confirm it is you with the code from your current phone.
2. Enter the new number, get the code on it and confirm. The next codes go to the new number.

#Turn verification off

Only those not required to have it: a member in a community without the default turned on.

Tap Turn off, confirm it is you with the code and confirm. Signing in asks only for the password again, the recovery codes stop working and the remembered devices are removed. For the team and the SuperAdmin, the section explains that verification is always used, without the button.

#Ask members

Role: owner.

1. Open Settings › Access and sign-up.
2. On the Two-step verification for members card, turn on Ask members for two-step verification.

#I lost my phone

1. At the code step, tap Use a recovery code and type one of the codes you saved.
2. Once in, change the phone in My account › Security and create new codes.

Without the phone and without any recovery code, contact Memberfy support. There is no code by e-mail: the SuperAdmin checks your identity first, turns off verification on the account with the reason recorded, and you get an e-mail about it. If your role requires verification, turn it on again at your next sign-in.

#Examples

New admin. Ana becomes an admin. When she opens the panel, she sees the notice with the 7-day deadline, taps Turn on now, confirms her WhatsApp and keeps the codes. On the office laptop, she checks Remember this device for 90 days.

Protected payout. The owner requests a payout. Before it goes, the Confirm it is you window asks for the WhatsApp code; with it, the payout goes through.

A community that asks everyone. The owner turns on the default for members. Whoever comes in sees the invitation, turns it on in a minute and signs in with the code from then on.

#Common errors and how to fix them

#Frequently asked questions

How much does it cost? Nothing, neither for the community nor for whoever uses it. Memberfy pays for the messages, outside the community's quota.

Do I need an authenticator app? No. The code arrives on WhatsApp, or by text message.

Will I type a code every day? Not if you check Remember this device for 90 days. The code only comes back after that period, if you change your password or if you remove the device.

Can the owner require it from me? The team (admin, moderator, finance and the owner themselves) always uses verification. For members, the owner can ask, but nobody is blocked.

Does resetting the password skip verification? No. The next sign-in, with the new password, asks for the code.

What about API keys? A key keeps working without a code. Creating a new one asks for the extra step. For the team, after the deadline without verification, keys also stop reaching the team routes.

#Through the assistant

The assistant checks your verification with get_two_factor_status: whether it is on, whether your role requires it and until when, the masked phone, the recovery codes left and the remembered devices. Turning it on or off and typing codes happen only in the app, never in the conversation: the assistant returns the link to My account › Security and never asks for a code. An action that needs the extra step (such as a payout) comes back with the link to do it in the app. See Security and limits.

#In the API

Signing in with verification on answers twoFactorRequired: true and a challengeId, and finishes at POST /api/auth/login/two-factor; management lives under /api/auth/two-factor/*, and the extra step goes in the X-Step-Up-Token header. See Authentication › Two-step verification and the errors.

#Related

• Account and profile
• Roles and permissions
• Payout
• Integrations & APIs
• Assistant security and limits