Skip to content

Two-step verification methods

Two-step verification (2FA) asks users for a one-time code in addition to their password. The methods users can verify with are enabled platform-wide here, in the System tenant; whether 2FA is required is decided per organization or per user on the customer side (see Two-step verification in the Administration Guide). Until at least one method is enabled below, customer portals show "2-step verification is not configured on this system" and enforcement settings have no effect.

Go to Administration › User Authentication › 2-Step Verification Methods. The page lists the three methods, each with its status and a Configure link:

  • Time-based one-time password verification (TOTP) — authenticator apps.
  • SMS-based verification — codes sent by text message via Twilio.
  • Email-based verification — codes sent by email.

Users enroll their methods themselves from My Profile › Security (see Account security in the User Guide).

TOTP (authenticator app)

The recommended method — no external service or per-message cost.

  1. Click Configure next to TOTP verification.
  2. Select Enable time-based one-time password verification.
  3. Use the Test application section to verify: scan the QR code (or enter the secret key) in an authenticator app — Microsoft Authenticator, Google Authenticator, Authy, and similar — and confirm a generated code with Verify Code.
  4. Save.

SMS via Twilio

SMS codes are sent through a Twilio account you provide. You need an upgraded (paid) Twilio project with an SMS-capable phone number; for throughput above 1 SMS per second, combine several numbers into a Twilio Messaging Service.

  1. Click Configure next to SMS-based verification and select Enable.
  2. Enter the Twilio Account SID and Twilio Auth Token from the Twilio console's project info.
  3. Set Twilio phone number or Messaging Service ID — a Twilio number you own in E.164 format (for example +16175551212), a short code, or a Messaging Service SID.
  4. Choose the Verification code length (6–8 digits) and optionally edit the Text message template sent to users.
  5. Use Test connection settings — enter a country code and phone number and click Test a Connection; confirm the test SMS arrives.
  6. Save.

Note

Twilio charges per message and per phone number — see Twilio's SMS pricing. Protect the Twilio account itself with 2FA on the Twilio side.

Email

Email codes are sent through the platform's SMTP integration, so configure email first — the page warns "SMTP is not configured" (or "Warning! Webportal URL is not configured." — the URL is set in Advanced settings) until the prerequisites are in place.

  1. Click Configure next to Email-based verification and select Enable.
  2. Choose the Verification code length (6–8 digits).
  3. Use Test connection settings — enter an email address and click Test a Connection; confirm the code email arrives.
  4. Save.

The wording of the code emails comes from the 2-step verification sign in template (and its setup counterpart) in the email template catalog — see Email.

After enabling

Two-step verification is considered "on" as soon as at least one method is enabled. Organizations can then require it for all users or non-SSO users, and individual accounts can be flagged to require it — both are customer-side settings documented in Two-step verification.

  • Password policy — where the system-default 2FA enforcement lives.
  • Email — SMTP configuration and email templates.