Two-factor authentication
Two-factor authentication (2FA) puts a second lock on your sign-in: your password, then a six-digit code from an authenticator app on your phone. Someone who has your password still cannot get in without the phone.
On WorkZerk it is not entirely optional. You cannot add an Upload request until 2FA is on, because an Upload request collects other people's documents (insurance certificates, licenses, ID) and those files then sit behind your login. Try without it and the requests panel refuses, with a link to your Account page. Set it up before you build your first portal.
The page is Account, then Two-factor authentication.
It needs a verified email. Until you have verified your email address, the page shows Verify now in place of the button to turn it on.
Turning it on
You need an authenticator app: Google Authenticator, Microsoft Authenticator, Authy, 1Password, or the one built into your password manager. Any of them work. There are no codes by SMS or email.
Click Enable two-factor authentication and you get a QR code to scan, a Setup key (the same secret as text, for apps that cannot scan), and a box for the current six-digit code. Type the code and click Verify & enable. Spaces and dashes are ignored, so a code your app displays as "123 456" is fine.
Get the code wrong and the page keeps the same secret, so the entry in your app stays valid and you can try the next code. A code that keeps failing is nearly always the clock on your phone: turn on automatic date and time and try again.
Recovery codes
The moment 2FA is on you are shown ten recovery codes. Save them before you click I've saved my codes. They are shown once, and there is no way to read them back afterwards.
Each one works a single time in place of a code from your app. The 2FA page keeps a count of how many you have left, warns you when you are down to three, and turns that warning red at zero. Generate new recovery codes asks you to confirm first, because every unused code from the old set stops working. Click Generate new codes and you get a fresh ten, so replace the whole saved batch rather than adding to it.
Keep them somewhere that is not the phone holding your authenticator app. If you lose the phone, you want the codes to still exist.
Signing in from then on
Email and password as usual, then a page asking for the Authenticator code. Every sign-in asks. There is no option to trust a device.
If your phone is not to hand, click Lost your phone? Use a recovery code on that page instead. The code you use is spent afterwards.
If you lose the phone and the recovery codes together, nothing on our side can generate a code for you. Email [email protected] from the address on the account and we will verify who you are before we switch it off for you.
Turning it off, and when you cannot
Disable two-factor asks for your password, not a code, so it still works if your phone has died. Click Turn off two-factor to finish. Turning it off resets the secret, so re-enabling later means scanning a fresh QR code, and your old recovery codes stop working. Your other signed-in sessions (another browser, your phone) are signed out within about 30 minutes; the one you are using stays signed in.
Now the part that surprises people. You cannot turn 2FA off while your account holds any Upload request at all. Instead of the password box you get "Can't turn this off yet". That includes an Upload request that everyone has answered, because the files it collected are still there. The only way to unlock it is to delete those requests, which removes the uploads with them. Requests of every other kind have no effect on this.
Requests on the sample portal are left out of the check, so demo data cannot lock you in.
What 2FA does not cover
It protects your sign-in, not the links you hand out. A person's portal link opens without any password, which is the point of it. If a link has gone somewhere it should not have, revoke it (see resending and revoking a link).
Getting help
If the Disable button is locked and you cannot work out which requests are holding it, email [email protected] and we will tell you which portals they are on.