# Two-step verification

> Besides your password, signing in asks for a code sent to your phone on WhatsApp (or by text message). How to turn it on in My account › Security, the 10 recovery codes, remembering a device for 90 days, the extra step before sensitive actions, the team requirement and the default for members.

**Two-step verification** protects your account with a second step when you sign in: after the password, Memberfy sends a **6-digit code to your phone on WhatsApp** (or by text message), and you only get in with it. Even if someone learns your password, they cannot sign in without the code from your phone.

You don't need an authenticator app and it costs nothing: **Memberfy pays for the messages**, and the code does not count against the community's text message and WhatsApp quota.

Since the [account](/conceitos/conta-e-perfil) is one per community, so is the verification: turned on here, it applies to your sign-in in this community.

## What it's for

| Who | What changes |
|---|---|
| Owner, admin and finance | Balance, payouts, the payout account and member data no longer depend on the password alone |
| Moderator | Moderation and member data sit behind a second step |
| Member | Your account and what you bought stay protected, even if the password leaks |
| Company or HR community | Meets the second-factor requirement for whoever accesses people's data |

## How it works

### Who must have it

| Who | Rule |
|---|---|
| **Team** (owner, admin, moderator and finance) | Always required. Whoever doesn't have it yet gets **7 days**, with a notice at the top of the screen: *"Turn on two-step verification by {date}. After that, the team screens and actions are blocked until you turn it on."* |
| **SuperAdmin** (Memberfy support) | Always required |
| **Member** | Optional. If the owner turned on the default for members, the person is **invited** to turn it on, never blocked |

The team deadline starts the first time the person uses a team screen or action without verification. After the deadline, the team screens and actions are blocked (*"The team screens and actions are blocked: turn on two-step verification to continue."*), and that person's [API keys](/configuracoes/integracoes-e-apis) also stop reaching the team routes. The way to turn it on is always open: **My account › Security** and the notice's **Turn on now** button. Once it is on, everything works again right away.

### The default for members

In **Settings › Access and sign-up**, the **Two-step verification for members** card has the option **Ask members for two-step verification**. Only the owner changes it (*"Only the owner changes this option."*).

- **Off** (default): each member decides whether to turn theirs on.
- **On**: members without verification see the invitation *"This community asks you to turn on two-step verification to protect your account."*, with **Turn on now** and **Not now**. Nobody is blocked. Whoever turns it on can no longer turn it off while the option is on.

### Signing in with a code

With verification on, signing in with the right password opens the **Two-step verification** step:

- *"We sent a code on WhatsApp to {phone}."*, with the number masked. Type the 6 digits in **6-digit code** and tap **Sign in**.
- **Get it by text message** sends the code by text message. If WhatsApp doesn't accept the number, the code already goes by text message.
- **Remember this device for 90 days**: on this browser, the next sign-ins ask only for the password until it expires.
- **Use a recovery code**: sign in with one of the [recovery codes](#the-recovery-codes) if your phone isn't with you.

A wrong password does not trigger a code. A wrong code shows how many attempts are left; when they run out, ask for a new code. If the code request expires, the screen asks you to sign in with the password again. Connecting an [AI assistant](/mcp/seguranca#two-step-verification) goes through the same sign-in and also asks for the code.

### The recovery codes

When you turn it on, the screen shows **10 recovery codes**, **only once**, with **Copy** and **Download**. It only finishes after you check **I saved the codes somewhere safe**. Each code works once, in place of the phone code.

- When you sign in with a recovery code, it stops working, the screen says how many are left and you get an alert e-mail.
- With few codes left, **My account › Security** warns you. **Create new recovery codes** replaces all 10: the old ones stop working.

### Remembered devices

In **My account › Security**, **Remembered devices** lists the browsers where signing in does not ask for the code, with the browser and system, the last use and how long it is valid. **Remove** forgets one; **Remove all** forgets all of them (your current session stays). Changing the password or turning verification off also removes them all.

### The extra step

With verification on, some actions ask for **a new code right then**, even when you are already signed in: the **Confirm it is you** window sends the code to your phone and only goes on after it.

| Action | Where |
|---|---|
| Turn verification off | **My account › Security** |
| Change the verification phone | **My account › Security** |
| Create new recovery codes | **My account › Security** |
| Create an API key | [Integrations & APIs](/configuracoes/integracoes-e-apis) and **My account › API keys** |
| Request a payout | [Payout](/pagamentos/saque) |
| Change the payout account | **Settings › Payouts** |

After you confirm, the next actions on the list don't ask for another code for a few minutes. In a Memberfy support session (the SuperAdmin's **Sign in**), these actions are not available: only the person does them, in their own account.

### Security activity

**Security activity** shows the recent verification events on your account: turned on, turned off, phone changed, device remembered or removed, recovery code used, new codes created and verification reset by support. Turning it on, turning it off, using a recovery code and a reset by support also send you an e-mail.

## Step by step

### Turn verification on

*Role: anyone, on their own account.*

1. Open **My account › Security** (`/account?tab=security`).
2. Under **Two-step verification**, tap **Turn on two-step verification**.
3. Enter the **Phone** (a number with WhatsApp), choose **Send the code by** WhatsApp or text message and tap **Send code**.
4. Type the code and tap **Turn on**. The number becomes your account's confirmed phone.
5. Keep the 10 recovery codes (**Copy** or **Download**), check **I saved the codes somewhere safe** and tap **Done**.

The section then shows **On**, the phone, the date, the recovery codes left and the remembered devices. In a country without supported WhatsApp or text messages, you cannot turn it on, and the screen explains why.

### Change the phone

1. In **My account › Security**, tap **Change phone** and confirm it is you with the code from your current phone.
2. Enter the new number, get the code on it and confirm. The next codes go to the new number.

### Turn verification off

*Only those not required to have it: a member in a community without the default turned on.*

Tap **Turn off**, confirm it is you with the code and confirm. Signing in asks only for the password again, the recovery codes stop working and the remembered devices are removed. For the team and the SuperAdmin, the section explains that verification is always used, without the button.

### Ask members

*Role: owner.*

1. Open **Settings › Access and sign-up**.
2. On the **Two-step verification for members** card, turn on **Ask members for two-step verification**.

### I lost my phone

1. At the code step, tap **Use a recovery code** and type one of the codes you saved.
2. Once in, change the phone in **My account › Security** and create new codes.

Without the phone and without any recovery code, contact Memberfy support. There is no code by e-mail: the SuperAdmin checks your identity first, turns off verification on the account with the reason recorded, and you get an e-mail about it. If your role requires verification, turn it on again at your next sign-in.

## Examples

**New admin.** Ana becomes an admin. When she opens the panel, she sees the notice with the 7-day deadline, taps **Turn on now**, confirms her WhatsApp and keeps the codes. On the office laptop, she checks **Remember this device for 90 days**.

**Protected payout.** The owner requests a payout. Before it goes, the **Confirm it is you** window asks for the WhatsApp code; with it, the payout goes through.

**A community that asks everyone.** The owner turns on the default for members. Whoever comes in sees the invitation, turns it on in a minute and signs in with the code from then on.

## Common errors and how to fix them

| Message or situation | What to do |
|---|---|
| *"Wrong code. N attempts left."* | Check the most recent code; earlier ones stop working when a new one arrives |
| *"No attempts left for this code. Ask for a new code below."* | Ask for another code, on WhatsApp or by text message |
| *"Too many codes requested. Try again later."* | Wait a little, or use a recovery code |
| *"This code request has expired. Sign in with your password again."* | Tap **Sign in again** and repeat the sign-in |
| The code doesn't arrive on WhatsApp | Tap **Get it by text message** |
| *"The team screens and actions are blocked…"* | The 7-day deadline is over: turn on verification in **My account › Security** |
| *"This action is not available in a support session…"* | The action belongs to the person, in their own account |

## Frequently asked questions

**How much does it cost?**
Nothing, neither for the community nor for whoever uses it. Memberfy pays for the messages, outside the community's quota.

**Do I need an authenticator app?**
No. The code arrives on WhatsApp, or by text message.

**Will I type a code every day?**
Not if you check **Remember this device for 90 days**. The code only comes back after that period, if you change your password or if you remove the device.

**Can the owner require it from me?**
The team (admin, moderator, finance and the owner themselves) always uses verification. For members, the owner can ask, but nobody is blocked.

**Does resetting the password skip verification?**
No. The next sign-in, with the new password, asks for the code.

**What about API keys?**
A key keeps working without a code. Creating a new one asks for the extra step. For the team, after the deadline without verification, keys also stop reaching the team routes.

## Through the assistant

The assistant checks your verification with [`get_two_factor_status`](/mcp/ferramentas-membros#get-two-factor-status): whether it is on, whether your role requires it and until when, the masked phone, the recovery codes left and the remembered devices. Turning it on or off and typing codes happen **only in the app**, never in the conversation: the assistant returns the link to **My account › Security** and never asks for a code. An action that needs the extra step (such as a payout) comes back with the link to do it in the app. See [Security and limits](/mcp/seguranca#two-step-verification).

## In the API

Signing in with verification on answers `twoFactorRequired: true` and a `challengeId`, and finishes at `POST /api/auth/login/two-factor`; management lives under `/api/auth/two-factor/*`, and the extra step goes in the `X-Step-Up-Token` header. See [Authentication › Two-step verification](/api/autenticacao#two-step-verification) and the [errors](/api/respostas-e-erros#two-step-verification).

## Related

- [Account and profile](/conceitos/conta-e-perfil)
- [Roles and permissions](/conceitos/papeis-e-permissoes)
- [Payout](/pagamentos/saque)
- [Integrations & APIs](/configuracoes/integracoes-e-apis)
- [Assistant security and limits](/mcp/seguranca)