Team & platformGuide

Two-step sign-in (2FA)

With two-step sign-in on, your password is not enough: Waiso also asks for a 6-digit code from an authenticator app on your phone — Google Authenticator, Microsoft Authenticator, 1Password, Authy or any app that reads a QR code. Someone who learns your password still cannot get in.

5 min readOpen in Waiso
What you will learn
  • Turn two-step sign-in on and save your recovery codes
  • Sign in with a code, a recovery code or a trusted browser
  • Get back in after losing your phone
  • Require it for everyone in your workspace

Turn it on

  1. Open your profile

    Go to Settings → Profile and, in Two-step sign-in, press Turn on.

  2. Scan the QR code

    Scan it with your authenticator app. No camera? Type the key shown beside it instead.

  3. Type the code

    Type the 6-digit code the app shows now. Two-step sign-in is on only after this code is right.

  4. Save your recovery codes

    You get 10 recovery codes, shown once. Copy or download them and keep them somewhere safe — each one lets you in once if you lose your phone.

Turn on two-step sign-in
Scan this code with your authenticator app.
Can't scan? Type this key:JBSW Y3DP EHPK 3PXP
BackTurn on
Turning it on: scan the QR code (or type the key), then the code from the app.

Signing in

After your password — or after Google or GitHub — Waiso asks for the code. Tick Trust this device for 30 days on your own computer and it will not ask there again for a month. Changing your password, turning two-step sign-in off or Forget all in your profile ends every trusted browser.

Two-step verificationType the 6-digit code from your authenticator app.☐ Trust this device for 30 daysVerify
Use a recovery codeBack
The second step of a sign-in: the code, trusting the device, and a recovery code if the phone is not at hand.

Lost your phone?

  • On the code screen, choose Use a recovery code and type one of your saved codes. Then set two-step sign-in up again on the new phone.
  • No recovery codes either? Ask an admin of your workspace: in the people list they can Reset two-step sign-in. You are signed out everywhere and sign in again with your password.
  • Running low? New recovery codes in your profile makes 10 new ones; the old ones stop working.

Require it for your workspace

Admins open Settings → Security and turn on Require two-step sign-in. Choose how long people have to set it up — 7 days or immediately. Until then they see a banner with the deadline; after it, Waiso shows only the setup until it is done. You can also stop people from trusting a device for 30 days.

SecurityHow people of this workspace sign in.
Sign-in rules
Require two-step sign-inEveryone must set it up.
Time to set it up7 daysImmediately
3 people don't have it yet.
Allow trusting a device for 30 days
Save
Settings → Security: require two-step sign-in, the time to set it up, and trusted browsers.
  • You must have two-step sign-in on yourself before requiring it.
  • People who sign in with your company SSO are never asked for this code: your company’s sign-in is their second step.
  • MCP tokens, API tokens, share links and approval links keep working as before — they are not a person signing in.

Related topics