Two-step sign-in

Last updated 2 October 2026

Protect your account with a code from an authenticator app.

Two-step sign-in means a password alone is not enough to get into your account. After your password you also enter a six-digit code from an authenticator app on your phone, so someone who learns or guesses your password still cannot sign in as you.

Turn it on

Open Devices in the sidebar, then choose Two-step sign-in and recovery codes.
Press Set up two-step sign-in.
Scan the picture with an authenticator app on your phone, or type the key into the app by hand.
Type the six-digit code the app shows and press Turn on.
Save the ten recovery codes that appear. They are shown once.

Signing in

Enter your email and password as usual, then the code from the app. Each code works once and changes every thirty seconds. A run of wrong codes pauses further tries for a few minutes.

If you lose your phone

Use a recovery code in place of the six-digit code. Each recovery code works once. When you are running low, make a new set from the same page; the old ones stop working.

If you have no recovery codes left, ask an Owner or Admin to reset it for you under Admin, then Members. That signs you out everywhere and emails you, and you can set it up again afterwards. An Owner cannot be reset by anyone else, so keep your recovery codes somewhere safe.

What it covers

It applies when you sign in with a password. If you sign in with Google, Microsoft or your company single sign-on, that provider does its own checks.

Turning it off asks for your password, so someone using a browser you are already signed in on cannot switch it off.

Requiring it

The Owner can make two-step sign-in compulsory under Admin, then Sign-in policy. It is off until the Owner switches it on, and the Owner needs it on for their own account first. The Owner chooses who it covers: Owners and Admins only (the default), or everyone who signs in with a password. Everyone it covers gets a number of days to set it up (7 unless the Owner chooses another, from 0 to 30), with a reminder at the top of every page. After that they can still sign in, but nothing else opens until they have set it up, and they cannot turn it off again while the rule is on. People who sign in with Google, Microsoft or single sign-on are not affected, and when only Owners and Admins are covered, nobody else is.

Was this not what you needed? Email support@intercomchat.com and tell us what you were trying to do.