Two-Factor Authentication

Two-factor authentication (2FA) adds a second step to signing in to Bookkeep. After your password, or after "Log in with Google", Xero or Intuit, Bookkeep asks for a 6-digit code from an authenticator app on your phone, such as 1Password, Google Authenticator or Authy. Someone who learns your password still can't get in without your phone.

2FA is optional for each person, and a company's primary admin can require it for everyone with access to the company.

Turning On Two-Factor Authentication

1. Open your profile and select the Security tab.
2. Choose Set up.
3. Scan the QR code with your authenticator app. If you can't scan it, enter the key shown under the QR code into the app instead.
4. Enter the 6-digit code the app shows and choose Turn on.

Bookkeep then shows ten recovery codes. Each one signs you in once if you lose your phone. Save them somewhere safe, such as a password manager, then choose I saved them, continue. They aren't shown again, but you can generate new ones at any time.

Signing In With Two-Factor Authentication

Sign in as usual. Bookkeep then asks for the 6-digit code from your authenticator app. Enter it and choose Verify.

• No phone to hand? Enter one of your recovery codes in the same box instead. Each code works once. Bookkeep tells you how many you have left.
• Trust this device for 30 days: tick this to skip the code on this browser for 30 days. Only use it on a computer that's yours.
• Took too long? The code step expires after 10 minutes. Sign in again to get a fresh one.

caution

Six wrong codes in a row lock your account. Bookkeep emails you a link to unlock it, or it unlocks by itself after 30 minutes.

Managing Two-Factor Authentication

Your profile's Security tab shows when you turned 2FA on and how many recovery codes you have left. From there you can:

• Generate new recovery codes. Enter a current code from your app (or a recovery code) to get ten new ones. Your old recovery codes stop working.
• Forget trusted devices. Every browser you chose to trust asks for a code again at its next sign-in.
• Turn off two-factor authentication. Enter a current code (or a recovery code) to confirm. This option isn't available if your company requires 2FA.

Trusted devices are also forgotten whenever your password changes or is reset, and whenever a recovery code is used.

Security Emails

Bookkeep emails you from Bookkeep Support (support@bookkeep.com) when:

• 2FA is turned on or off for your account
• one of your recovery codes is used
• Bookkeep support turns off 2FA for you

Each email says when it happened and, for changes you made, the device and IP address. If it wasn't you, reset your password straight away and reply to the email so we can help secure your account.

Lost Your Phone?

Sign in with one of your recovery codes, then go to the Security tab and set up 2FA again on your new phone. If you no longer have your recovery codes, contact support@bookkeep.com. We'll confirm it's really you before turning off 2FA so you can set it up again.

Requiring Two-Factor Authentication for Your Company

A company's primary admin can require 2FA for everyone with access to the company. To do it:

1. Turn on 2FA for yourself first. Until you do, the option can't be switched on.
2. Open Company Settings and select the Users tab.
3. Under Require two-factor authentication, choose Turn on.

Once it's on:

• It covers everyone with access to the company. That includes company members, and people with Entity access only, who can open one or more of your entities without belonging to the company.
• People without 2FA are asked to set it up straight away. Anyone already signed in is signed out on their next page load and walked through the setup before they can continue. The setup page says that your company requires it.
• It applies to every sign-in to their Bookkeep account, not only while they're working in your company. If someone belongs to several companies, one company requiring 2FA is enough.
• People can't turn 2FA off while a company they belong to requires it. Their Security tab says which company requires it.

The Users tab shows each person's status to admins and the primary admin: 2FA on, or No 2FA. No 2FA turns amber while your company requires 2FA, because that person will be asked to set it up the next time they use Bookkeep.

To stop requiring it, choose Turn off under Require two-factor authentication and confirm. People keep 2FA if they set it up, but can turn it off again. Bookkeep records who turned the requirement on or off, and when.

note

The requirement applies to signing in to Bookkeep. It doesn't change how the Bookkeep app inside Shopify Admin works, and it doesn't apply to API keys, which are managed separately.

If you have any questions, contact support@bookkeep.com.