Passwords leak. On a platform that can send millions of messages and move credit between accounts, that is not a small problem. Google Authenticator 2FA adds a 6 digit code on top of the password, and it costs you nothing to switch on.
Admin accounts first
Do your own team before you do your customers.
- Go to the admin list and click Edit on the admin account.
- In the modal, click Google Authenticator. You land on the setup page.
- On the phone, open the Google Authenticator app and scan the QR code. The account appears with a rotating 6 digit code.
- Back on the Verify Google Authenticator page, type the current code and click Verify.
That is it. From then on, that admin needs the password plus the code.
Every admin account should have this on. Admin accounts can change routing, move credit and see client traffic, so a leaked admin password is the worst case on your platform.
Enabling 2FA for users
- Go to Users → Edit User → Global Attributes.
- Under OTP Login Settings, set Enable OTP Login to Yes.
- Save.
The user then sees a 2FA tab on the Security page of their panel, where they scan the QR code, enter the 6 digit code and verify.
Forcing everyone to use it
If you want it mandatory rather than optional:
- Go to Settings and open the OTP Verification tab.
- Set Force Users for Google Auth to Enabled.
Users who have not set 2FA up get redirected until they finish the setup. Tell your customers before you flip this, otherwise your support queue fills up the same morning.
Shared logins
Plenty of client accounts are shared by a team, which 2FA normally breaks. The practical workaround is for the user to save the QR code image when they set it up, so colleagues can scan the same code. Better still, give each person their own sub user, but that is a conversation, not a setting.
When someone loses their phone
Users cannot remove their own 2FA, which is the point. They raise it with you, and you do it:
- Edit User → Global Attributes → OTP Login Settings
- Click Delete Google Auth.
They do not need to log out. The next page they open redirects them to the 2FA tab to set it up again.
Verify who you are talking to before you reset 2FA. A phone call from “the client” asking you to remove their second factor is exactly what an attacker would do.
Related articles
- Security Monitoring: How Automatic IP Blocking Protects Your Platform
- Admin Roles and Permissions
- Login Trails and Attempts Logs: Your Access Audit Trail
- Can I enable 2 factor authentication with OTP SMS for a user?
- Does your software come with OTP verification for user registration and logins?