Set Up Two-Factor Authentication

Add an authenticator-app code to your sign-in for extra security.

Two-factor authentication (2FA) adds a second step when you sign in: a 6-digit code from an authenticator app. This guide shows how to turn it on and off.

What you'll need

  • An authenticator app on your phone (for example Google Authenticator, Microsoft Authenticator, or Authy).

Turn on 2FA

  1. Go to Settings > Security.
  2. Start the 2FA / MFA setup. Coco HR shows a QR code and a secret key.
  3. In your authenticator app, add a new account by scanning the QR code (or entering the secret manually).
  4. Enter the 6-digit code from your app to verify.
  5. Once verified, 2FA is enabled.

Sign in with 2FA

After 2FA is on, signing in takes an extra step:

  1. Enter your email and password as usual.
  2. When prompted, enter the current 6-digit code from your authenticator app.

Turn off 2FA

  1. Go to Settings > Security.
  2. Select Disable.

Good to know

The Security page currently offers only TOTP-based 2FA. It does not include password policies, session management, SSO configuration, or IP allowlisting. (Single sign-on with Google and Microsoft is available at sign-in itself.)

Tips

  • Save your authenticator setup on a device you'll keep — losing access to your app means losing your codes.
  • Enable 2FA for admin accounts especially, since they can reach billing and integrations.