Two-step sign-in

Set up a code from an authenticator app, keep your recovery codes safe, and what to do if you lose your phone.

Updated 18 October 2026

Why this exists

A password alone can be guessed or stolen, and your account can reach families' records. Two-step sign-in adds a code from your phone, so a stolen password is not enough to get in. It takes a few minutes to set up and protects you and every family you work with.

Two-step sign-in asks for a six-digit code from an app on your phone each time you sign in on a new device. A stolen password alone then cannot open your account.

Who must use it

Owners, admins and finance staff always need it, because they can reach every family's records and the centre's money.
Your centre can require it for all staff, tutors included.
Anyone who must use it gets some days to set it up. After that, the portal will not open until you do.
Anyone can turn it on, even if it is not required.

Set it up

Install an authenticator app on your phone, such as Google Authenticator or Microsoft Authenticator.
In the portal, open Settings and press Manage next to two-step sign-in.
Press Turn on two-step sign-in.
Scan the code with your app, or type the key shown under it.
Type the six digits your app shows and press Continue.
Save your recovery codes somewhere safe, away from your phone. Each code works once.

Signing in

After your password, enter the current code from your app. Codes change every 30 seconds.

If you lose your phone

On the code screen, choose Use a recovery code and type one of your saved codes.
Once you are in, set up two-step sign-in again on your new phone.
Make new recovery codes if you have used most of them.

No recovery codes left? Ask your centre's admin to reset it for you.

For admins

To require it for everyone, go to Settings > Your centre, tick Require two-step sign-in for all staff, tutors included, set Days to set it up (up to 60) and save.
To reset someone who is locked out, open them under People > Logins and roles and press Reset two-step sign-in. You can only reset people at your own centre and campuses, never yourself. They set it up again next time they sign in.
Some sensitive actions (role changes, exports, refunds) always ask for two-step sign-in, even during the set-up days.