Multi-factor authentication

Multi-factor authentication (MFA) adds a second layer of security to your account. After entering your password, you provide a time-based one-time code from an authenticator app — so even if your password is compromised, your account stays protected.

Compatible authenticator apps

FSM Navigator® supports any TOTP-compatible authenticator app. Popular options include:

Set up MFA on your account

1. Navigate to Settings → Security & MFA.
2. Click Enable MFA.
3. Open your authenticator app and scan the QR code displayed on screen.
4. Enter the 6-digit code shown in your authenticator app.
5. Click Verify and Enable.

Log in with MFA

1. Enter your email and password as usual.
2. When prompted, open your authenticator app.
3. Enter the current 6-digit code.
4. Click Verify.

Codes refresh every 30 seconds. If a code expires before you submit it, wait for the next one.

MFA applies the same way when you sign in with Google, Microsoft, or Apple: after the provider signs you in, FSM Navigator asks for your authenticator code before your session starts.

Sign-in verification codes by email

Sometimes FSM Navigator asks you to confirm a sign-in with a 6-digit code sent to your account email, even if you don't use an authenticator app. This happens when a sign-in looks unusual for your account, or when we need to double-check recent activity before letting you back in.

1. Sign in as usual — with your password, or with Google, Microsoft, or Apple.
2. Check your email for a message with a 6-digit verification code.
3. Enter the code on the sign-in screen and click Verify.

You are not signed in until the code is entered. The code expires after 10 minutes; if it does, click Resend code. For this step only the emailed code works — an authenticator code or a recovery code is not accepted.

An emailed code only works for the step it was sent for. The email says which step that is: a sign-in code, a set-up code, a confirmation code, a code to change a passkey, a code to turn off your authenticator app, or a code for new recovery codes. A sign-in code can't confirm a passkey change, and a code for a passkey change can't sign you in. Asking for a new code replaces your earlier code for that same step and leaves codes for other steps alone.

If you receive a verification code you did not ask for, someone may know your password. Change your password right away and let your account Owner know.

Company-wide MFA enforcement

Owners can require two-step sign-in for every user in the company.

Enable enforcement

1. Go to Settings → Security & MFA.
2. Under Sign-in requirement, choose Two-step sign-in (authenticator app or passkey), or Passkey required to accept passkeys only. See Passkeys.
3. Set an enforcement date — the deadline by which all users must enable MFA.
4. Optionally set a grace period (in days) to give your team time to comply.
5. Click Save. To protect you from locking yourself out, the save is refused unless your own account already has two-step sign-in (or you are exempted). When the change raises the requirement, you first see how many people will need to set it up, and you can cancel before anything is saved.

What happens when enforcement is active

• When the requirement is turned on with an enforcement date, everyone who still needs to set it up gets one email with their deadline.
• Until their deadline, they see a reminder at the top of each page with the deadline and a link to set it up. They can dismiss it for the rest of their visit.
• Once the deadline passes, users who have not set up the required sign-in method can no longer sign in the normal way. Instead they get a short set-up session (see Signing in after the deadline) that does nothing except let them add a passkey or an authenticator app. Anyone still signed in is signed out at their next action.
• If you set up an authenticator app but are still signed in with only your password when your deadline passes, you are signed out once and asked to sign in again with your code.
• While the requirement is on, connecting an AI app needs a two-step sign-in. If you signed in with only your password, sign out and sign in again with your code first.
• Owners can exempt specific users if needed (e.g., shared kiosk accounts).

Signing in after the deadline

Someone whose deadline has passed is not stuck at the sign-in page. They can set up the missing step themselves, with no help from an Owner:

1. Sign in with your email and password, or with Google, Microsoft, or Apple.
2. We email you a 6-digit set-up code. Enter it on the sign-in screen.
3. A Set up two-step sign-in screen opens. Choose Add a passkey, or Use an authenticator app if your company accepts app codes. When your company requires passkeys, only the passkey is offered. If you pick the app, scan the QR code (or type in the key), enter the code it shows, and save the recovery codes you are given.
4. When you finish, you are signed out. Sign in again as usual, now with your new second step.

A few things to know:

• The set-up session lasts up to 15 minutes, and the screen shows how long is left. If it runs out, sign in again to start a new one.
• It does one job. Nothing else in FSM Navigator opens until you finish, and the rest of your account is untouched.
• Adding a passkey here doesn't ask for a second emailed code, because the set-up code you just entered already confirmed it's you. If you already use an authenticator app, you still enter its code first.
• In the mobile app it works the same way. The app opens its own set-up screens, and you can copy the setup key or open your authenticator app straight from there. If your app is out of date, update it or do the set-up on the website.

Reminder notifications

FSM Navigator automatically sends email reminders to users who have not yet enabled MFA:

• 48 hours before the deadline
• 24 hours before the deadline
• 12 hours before the deadline

Disable MFA

If you need to turn off MFA on your own account:

1. Go to Settings → Security & MFA.
2. Click Disable MFA.
3. Enter your current 6-digit code to confirm.

Locked out after wrong codes

Five wrong codes in a row lock the second sign-in step for 15 minutes. This covers authenticator codes, recovery codes and emailed codes, including the set-up code you get after a deadline. A wrong code stops counting 15 minutes after you entered it, so an old mistake does not add to a new one.

If you can't wait out the lock, ask an Owner. On the Users page, a locked person's row shows Clear sign-in lockout. The Owner gives a reason (it goes in the audit log) and confirms. The lock ends straight away and nothing else changes: the person's authenticator app, passkeys and email sign-in all stay as they were.

Lost access to your authenticator

If you lose access to your authenticator app (new phone, uninstalled app), you have a few ways to recover:

1. Use a recovery code to sign in. On the verification screen, enter one of the backup recovery codes you saved when you enabled MFA.
2. Get a code by email. When regenerating your recovery codes or turning off MFA in Profile → Security, choose "Don't have your authenticator? Email me a code" — FSM Navigator emails a 6-digit verification code to your account email that authorizes the change, so you can recover without your authenticator. You will receive a security-alert email whenever this email-code path is used, so any unauthorized change is easy to spot.
3. Contact your company Owner — they can reset your MFA from the user management dashboard. Once reset, log in with just your password and set up MFA again on your new device.

Frequently asked questions

Related guides

• Security overview — how FSM Navigator protects your data
• Roles and access control — understand the permission model
• Team management — invite users and assign roles
• Security settings — configure MFA enforcement