Skip to content

Account security

From the Dashboard you manage your account's API keys, webhooks and credits. To protect access to it, in addition to your password you can enable two-factor authentication (2FA): every time you sign in, after your password you are asked for a temporary code generated by an app on your phone. Anyone who knows your password cannot get in without that code.

Two-factor authentication is optional, but we recommend it to everyone, especially if you use the live environment.

Your integrations don't change

2FA only protects access to the Dashboard. API calls keep authenticating with the API key alone: enabling 2FA has no effect on your integrations, the SDKs, the CLI or Desk.

Enable two-factor authentication

You need an authenticator app that supports TOTP codes, for example Google Authenticator, Microsoft Authenticator, 1Password or Bitwarden.

  1. Sign in to the Dashboard and open Profile → Two-factor authentication.
  2. Click Add authenticator app.
  3. Scan the QR code with your authenticator app, or enter the key shown below the QR code by hand. In the app the account shows up as Invoicetronic.
  4. Enter the 6-digit code shown by the app in the Verification Code field and click Verify.

From now on, every time you sign in you will be asked for the app's code after your password. If you select Remember this machine, you won't be asked for the code again on that browser.

Cookie consent

To enable 2FA you must have accepted the Dashboard's cookie policy: remembering your device relies on a cookie.

Recovery codes

Right after you enable 2FA, the Dashboard shows 10 recovery codes. Each code works for a single sign-in and replaces the app's code when you don't have your phone at hand: on the sign-in page, choose log in with a recovery code.

Save them right away

Recovery codes are shown only once. Store them somewhere safe, for example in your password manager.

When you are running low, the Dashboard warns you. You can generate new ones at any time with Reset recovery codes: the previous codes stop working.

Manage 2FA

From Profile → Two-factor authentication you can also:

  • Reset authenticator app: generates a new key, for example when you change phone. The previous key stops working and 2FA stays disabled until you set up the app again.
  • Forget this browser: from your next sign-in, the code will be asked again on the browser you had remembered.
  • Disable 2FA: you go back to signing in with your password only. The key doesn't change: to enable it again, click Set up authenticator app and enter a code from the app, with no need to scan the QR code again.