Two-factor login

Two-factor login asks for a 6-digit code from an authenticator app on your phone after your password. Someone who steals your password still cannot open your invoices or send invoices in your name.

1. Install an authenticator app, for example Google Authenticator, Microsoft Authenticator or Authy.
2. Go to Settings → My account and click Turn on two-factor login in the Security card.
3. Click Set up authenticator, scan the QR code with the app (or type the key shown under it), and enter the 6-digit code.
4. Save the 10 backup codes: Copy or Download them and keep them away from your phone. Tick I saved my backup codes and click Done.

From then on, Alya Books asks for the code after your password.

Lost your phone?

• With a backup code: on the code screen, click Use a backup code and enter one. Each code works once. It removes the old authenticator, and you set up a new one straight away.
• Without codes: click Lost your phone and backup codes? and explain what happened. The owners and admins of your companies are told. They, or Alya Books support, check that it is really you and approve the reset. You get an email, then sign in and set up a new authenticator.

Require it for your company

The owner can require two-factor login for everyone under Settings → Team → Two-factor login. Choose a grace period (none, 3, 7, 14 or 30 days) and switch on Require two-factor login. The owner must use two-factor login first. Members without it see a banner during the grace period. After it, they must set it up before they can open the company's data.

Good to know:

• Some changes ask for a fresh code if you have not entered one in the last 15 minutes: bank details, API keys, member roles and permissions, lock dates, reopening a filed VAT return, and the company's two-factor setting.
• New backup codes in the Security card replaces all previous codes. The card shows how many are left.
• You cannot turn two-factor login off while a company you belong to requires it. To move to a new phone, sign in with a backup code.
• Owners and admins see who does not use two-factor login yet, and reset requests, under Settings → Team.
• You get an email when two-factor login is turned on, when backup codes are renewed or used, and when a reset is decided.
• API keys are not affected: they keep working without a code.
• If someone is locked out and cannot use the reset request, Alya Books support can remove a user's two-factor login or switch off a company's requirement. Each is recorded with the reason, and the people concerned are told.

Related:

• Users and roles
• Member permissions