When completing your registration, you are automatically redirected to the setup wizard. You can also access the wizard through the 'Getting started' guide (step 'Secure your account'), which is visible as a pill or question mark in the interface. Please note: the guide is only visible to owners, not to team members.

The wizard consists of five steps:

1. Explanation — You read why 2FA is mandatory and what you need: your phone and approximately 3 minutes.
2. Install app — Download Google Authenticator or Microsoft Authenticator via the App Store or Google Play. The wizard shows direct links.
3. Scan QR code — Scan the QR code with your authenticator app. If that doesn't work, you can use the manual key (displayed in blocks of 4, with a copy button).
4. Enter code — Enter the 6-digit code from your app. The fields advance automatically and pasting also works. If you enter an incorrect code, you will receive an error message.
5. Save recovery codes — You receive recovery codes that you can download, copy, or print. You can only proceed after checking the box "I have saved my recovery codes in a safe place".

After the wizard, 2FA is active on your account.

After setting up 2FA, here's how logging in works:

1. Log in with your email address and password (or via Google).
2. Enter the 6-digit code from your authenticator app on the code screen.

Don't have access to your app? Click No access to your app? Use a recovery code and enter one of your recovery codes.

Watch out for these limits:

• 5 wrong codes during a single login attempt: you'll need to start the login process over.
• 10 wrong codes per quarter hour: your account will be temporarily blocked.

Go to Account → Security to view and manage your 2FA settings. Here you'll see:

• The date 2FA was set up.
• The number of recovery codes remaining (shown in red when 3 or fewer are left).

From this screen you can:

• Generate new recovery codes — Enter your current 2FA code to confirm. Your old codes expire immediately.
• Link a different authenticator app — Enter your current code and a new code from the new app.

Turning off 2FA is not possible.

As a team owner, you can reset a team member's 2FA via the team page:

1. Go to the team page and open the menu for the relevant team member.
2. Choose the option to reset 2FA.
3. Confirm the action on the confirmation screen (pay attention to the warning shown).

After the reset:

• The team member will be logged out everywhere.
• The team member will receive an email about the reset.
• The next time they log in, the team member will need to go through the wizard again.

You can't reset your own 2FA this way, and you can't reset the 2FA of Xendy employees either.

Xendy automatically sends an email for the following events:

• 2FA set up
• Recovery code used (including the number of codes remaining)
• New recovery codes generated
• Different authenticator app linked
• 2FA reset (including by whom)

Every email includes a "Don't recognize this?" link to the helpdesk. If you receive an email about an action you didn't take yourself, get in touch right away using that link.