Settings & team
Turn on two-factor authentication in Naffes CRM
With two-factor authentication on, your password alone no longer opens your Naffes CRM account: sign-in also asks for a six-digit code from an app on your phone that changes every 30 seconds. Setup takes two minutes, and each user turns it on for their own account.
Steps
Open security settings
Go to Settings → Personal → My Account → Sessions & Security. The Two-factor authentication section shows your current status.
Start setup
Click Turn on. A QR code and a text setup key appear.
Add Naffes to your authenticator app
Scan the code with an app such as Google Authenticator or Microsoft Authenticator. On the same phone, click Open in authenticator app, or click Copy key and choose to add an account with a setup key in the app.
Confirm with a code
Enter the six-digit code the app shows right now. If you see That code is not right, enter the current one; it changes every 30 seconds.
Save your recovery codes
Eight recovery codes are shown once only, and each signs you in once if you lose your phone. Click Copy codes, store them in a password manager or another safe place, then click I've saved them.
Once it is on
- Every sign-in asks for the code after your password, and a recovery code is accepted in its place.
- Continue with Google and Continue with Microsoft still ask for the code, so single sign-in does not bypass the second step.
- The section shows how many recovery codes you have left. When you run low, turn two-factor off and on again to get a fresh set.
- To turn it off, click Turn off and enter a current code or a recovery code.
Troubleshooting
- Codes are always rejected: codes are time-based, so make sure your phone's clock is set automatically from the network.
- You started setup but did not finish: the section says two-factor is not on yet. Click Start setup again and complete the steps.
- You lost your phone: sign in with a recovery code, then turn two-factor off and set it up again on the new phone.
- You want it on for the whole team: workspace admins cannot enforce two-factor for their team today, so make it part of onboarding right after you invite someone.
Questions
Questions 2
Is the two-factor data stored safely?
Yes. The secret that generates your codes is stored encrypted, and each recovery code works only once.
Does two-factor affect getting an API token?
Yes, on the sign-in route. With two-factor on, POST /api/token does not return a token straight away; it returns a challenge you complete with your authenticator code within 5 minutes. See creating an API token; active tokens are listed under Sessions & Security.