# Two-factor authentication for operator sign-in

Add an authenticator-app or email code to password sign-in and complete mandatory setup when your website requires it.

*Release 3.3 · admin, operator*

**Settings › Account › My Account** · **Settings › Account › Operators** · **Settings › General Settings › Admin**

## What it is

**2-Factor Authentication** adds a code check to your INSIDE password sign-in. You can activate **Auth Apps** or **Email** from your account settings.

Your website can require operators to complete setup before they sign in.

## Who uses it and why

Operators activate and verify their own factor. Users with the **Settings** or **Manager** role and the required operator permissions can enable or clear an operator's setup. Powerfront manages the website-wide requirement.

## Where to find it

Open **Settings › Account › My Account**, then **2-Factor Authentication**.

The operator-level switch is under **Settings › Account › Operators**. Powerfront manages **Enforce 2-Factor Authentication** under **Settings › General Settings › Admin**.

## How it works

To activate an authenticator app:

1. Choose **Auth Apps** under **Authentication Method:**.
2. Select **Activate Now** and confirm your password.
3. Scan the QR code with your authenticator app. Use **Can't scan QR code?** to enter the setup code manually instead.
4. Enter the generated code and select **Verify Code**.

To activate email verification, choose **Email**, select **Activate Now** and confirm your password. Enter the code sent to your registered email address and select **Verify Code**.

At later password sign-ins, enter the requested code. Email codes expire two minutes after they are requested. If website enforcement requires setup and you have not completed it, the sign-in screen guides you through setup first.

For an enrolled authenticator account, **Didn't get the code** offers an email fallback. A valid fallback code lets you sign in without changing your configured authentication method.

## Configure it

Ask Powerfront to turn on **Enforce 2-Factor Authentication** for your website. It is off by default.

You can use **Deactivate Now** in your personal setup when deactivation is available and confirm your password. Website enforcement will require setup again at a later password sign-in. An authorised account manager can also clear setup through the operator-level switch.

**Don't ask again for this computer** remembers successful verification in that browser. The default lifetime is 30 days; Powerfront can change it. You still need your password when signing in again.

### Settings

| Setting | Where | Applies to | Default | Who can change it | What it does |
|---|---|---|---|---|---|
| Enforce 2-Factor Authentication | Settings › General Settings › Admin | website | Off | Powerfront, on request | Require two-factor setup and verification during password sign-in. |
| 2-Factor Authentication | Settings › Account › Operators | operator | Off | Settings role, Manager role | Enable two-factor authentication for an individual account; disabling it clears its setup. |
| Authentication Method: | Settings › Account › My Account | operator | Auth Apps | Developer role, Co-Browse role, Manager role, Settings role, Chat role, Video Chat role, Live Shows role, Stats role, Monitor role, Top Stats role, Audit role, Bot Trainer role, Reports role, Reports Dashboard role, Store App role, Video Feed role | Choose Auth Apps or Email when activating two-factor authentication. |

### Permissions

| Permission | Lets you |
|---|---|
| Settings | Manage permitted operator accounts, subject to Settings Permissions. |
| Operators | Allow operator administration within Settings Permissions. |
| Manager | Manage permitted operator accounts, subject to Manager Permissions. |

## Limits and good to know

- Wait 60 seconds between email-code requests. Use the latest code you receive.
- Five failed email-code verifications clear the outstanding email code, so a new code is needed.
- Incorrect supplied codes also count towards the six-attempt sign-in lockout. Ask an authorised account manager to unlock a locked account.
- Password recovery clears factor setup. Complete setup again if enforcement is enabled.
- A remembered computer depends on its browser cookies and a valid remembered-computer token.

## Depends on and works with

### This feature uses

- **Requires** [Login and email verification](SEC-001.md): These factors apply to the operator password sign-in flow.
- **Configured in** Admin settings and feature switches (managed by Powerfront): Powerfront manages website-wide enforcement.
- **Configured in** [Operator accounts](ADM-007.md): Account management includes the operator-level authentication switch.
- **Configured in** [Roles and permissions](ADM-008.md): Operator-management permissions control who can edit another account.
- **Configured in** [Operator settings](ADM-010.md): Personal factor setup is in My Account.
- **Works better with** [Password changes and recovery](SEC-002.md): Password recovery clears two-factor setup, so enforced authentication must be set up again.
- **Works better with** [Logout and remembered computers](SEC-004.md): A remembered computer can skip the code prompt on later password sign-ins.
- **Related** [Sign-in and chat request limits](SEC-025.md): Incorrect supplied codes can count towards sign-in lockout, and email codes have separate retry limits.

### Used by

- **Configures** [Login and email verification](SEC-001.md): An account or website may require a second authentication factor.
- **Configures** [INSIDE operator CLI](EXT-023.md): The account's second-factor requirements apply to CLI sign-in.
- **Enhances** [Operator accounts](ADM-007.md): Two-factor authentication adds an account sign-in requirement.
- **Enhances** [Password changes and recovery](SEC-002.md): Password recovery resets two-factor setup, which may need to be completed again.
- **Enhances** [Logout and remembered computers](SEC-004.md): Remembered-computer verification can avoid a later second-factor prompt.
- **Enhances** [Operator access tokens](SEC-011.md): Remembered credentials can satisfy a subsequent second-factor check.
- **Related** [Sign-in and chat request limits](SEC-025.md): Email second-factor codes have resend and failed-verification limits alongside sign-in lockout.

## FAQ and troubleshooting

### Why is my email code rejected?

It may have expired, been replaced by a newer code or been cleared after failed attempts. Wait for the resend interval, request a new code and enter it within two minutes.

### What if I cannot scan the QR code?

Choose **Can't scan QR code?** and enter the displayed setup code into your authenticator app. Finish by verifying a generated code.

### I lost access to my authenticator app. Can I sign in?

Use **Didn't get the code** on the sign-in screen to request the email fallback. You need access to your registered email address.

### Why is INSIDE asking for a code on a remembered computer?

The remembered verification may have expired, its token may no longer be valid or the browser cookies may have been cleared. Complete the code check again.

### Why am I asked to activate it again after deactivating it?

Your website may enforce two-factor authentication. Deactivating your account setup does not turn off website enforcement.