Turn On Two-Factor Authentication

Last updated: 2026-07-09 Summary:

• Two-factor authentication (2FA) adds a one-time code from your phone on top of your password, so a stolen password isn’t enough to get in.
• You set it up per person, on your own account — there’s no plan or permission needed.
• Save your recovery codes when you turn it on. They are shown only once.

Turn it on

1. Click your avatar in the top-right corner and choose Security (/settings/security).
2. In the Two-factor authentication card, click Enable two-factor authentication.
3. Scan the QR code with an authenticator app — Google Authenticator, Microsoft Authenticator, Authy, or 1Password all work (any TOTP app does). Can’t scan? Expand Can’t scan? Enter this key and type the secret into your app by hand.
4. Your app now shows a rotating 6-digit code. Enter that code and click Enable two-factor authentication.
5. eKapital shows your recovery codes. Copy them with Copy all recovery codes and store them somewhere safe (a password manager is ideal). Each code works once and lets you in if you ever lose your phone.
6. Done — the card flips to Two-factor authentication is on.

Sign in with 2FA on

After you enter your password, eKapital asks for your current 6-digit code. Open your authenticator app and type it in, then click Verify.

Lost your phone? On that screen, tick Use a recovery code instead and enter one of the codes you saved. Each recovery code can only be used once.

Turn it off

1. Go back to Security and click Turn off two-factor.
2. Confirm in the dialog and enter your current 6-digit code from your authenticator app.
3. Click Turn off.

Where people get tripped up

• Didn’t save the recovery codes. They’re shown only at setup and there’s no screen to view or regenerate them later. If you didn’t save them, turn 2FA off and back on to get a fresh set — and save them this time.
• Turning it off needs the app code, not a recovery code. The recovery-code option is for signing in when you’ve lost your phone. The turn-off dialog asks for a live 6-digit code, so keep your authenticator until 2FA is off.
• Clock drift. If your codes are rejected, check that your phone’s time is set automatically — TOTP codes depend on an accurate clock.
• New phone. Moving to a new device? Turn 2FA off on the old phone (or use a recovery code to sign in), then turn it on again and scan the new phone.

See also

• Set up your company
• Invite and manage users