Two-factor authentication and passkeys
Protect your account with an authenticator app, passkeys or one-time codes, and set a two-factor policy for your firm.
Why turn on two-factor authentication
Two-factor authentication (2FA) asks for a second proof that it's really you when you sign in, on top of your password. It makes it much harder for someone with a stolen password to get into your firm's account. We recommend every user turn it on.
Set it up under My account → Sign-in security in the app.
Sign-in methods
Authenticator app
- Choose Authenticator app and scan the QR code with any standard authenticator app or password manager that supports one-time codes.
- Enter the six-digit code the app shows to confirm.
Passkeys
A passkey lets you sign in with your fingerprint, face or device PIN instead of typing a code.
- Choose Add a passkey and follow your device's prompt.
- Give the passkey a name, such as "Office laptop".
Passkeys work on both app.firmmarketing.com and support.firmmarketing.com. One passkey covers both, so you don't need to set it up twice. You can add passkeys on several devices.
Email codes
We send a one-time code to your email address. Handy as a backup, but less secure than an authenticator app or passkey.
Text message codes
We send a one-time code to your mobile phone. Also useful as a backup method.
Email sign-in links
Instead of a code, we email you a link that signs you in when clicked.
Recovery codes
When you turn on 2FA, you get a set of recovery codes. Each one works once and lets you sign in if you lose your phone or security key. Store them somewhere safe, such as your password manager. You can generate a new set at any time, which cancels the old ones.
Firm 2FA policy
Firm administrators can set a two-factor policy for everyone at the firm. When 2FA is required, anyone who hasn't set it up is asked to do so the next time they sign in. Requiring 2FA is the simplest way to make sure every login to your site is protected.
Password-free sign-in
If your firm turns it on in Site Settings, people can sign in without a password by requesting an email link. Each link can be used only once and expires after 15 minutes. If a link has expired, simply request a new one.
If you're locked out
- Use a recovery code, or another method you've set up.
- Ask a firm administrator to reset your 2FA.
- If no one at your firm can help, raise a support ticket at support.firmmarketing.com or email [email protected]. We'll verify your identity before making any change.
Account security requests are handled by a person. If the work goes beyond a quick reset, you'll get an estimate in 0.1-hour units at $225/hour to approve before we start. Routine edits handled by AI are free up to a monthly fair-use allowance (20 on Solo, 60 on Firm).