Two-Step Sign-in and Passkeys

Your AutoPhish account contains sensitive information about your organisation, so it is protected with two-step sign-in by default. You can make signing in even safer – and faster – with a passkey.

Where to find it

Go to Settings → Sign-in & Security. The section How you sign in shows whether two-step sign-in is on and how many passkeys you have registered.

Two-step sign-in (e-mail code)

Two-step sign-in is on for every account by default. After entering your password, AutoPhish e-mails you a 6-digit code. Administrators may know this as MFA (multi-factor authentication).

• The code is valid for 10 minutes.
• Resend code invalidates all earlier codes – always use the newest e-mail.
• After 5 wrong entries the code becomes invalid and you need to request a new one. After 10 failed attempts in a row, two-step sign-in is locked for 15 minutes.
• If you wait more than 30 minutes, you are asked to enter your password again.

Code not arriving? Check your spam folder and make sure your mail system accepts e-mails from AutoPhish.

Passkeys – the recommended way

A passkey lets you sign in with your fingerprint, face or device PIN. Passkeys are resistant to phishing and replace both the password and the e-mail code.

Add a passkey

1. Go to Settings → Sign-in & Security → Passkeys.
2. Click Add passkey and confirm with your Current password.
3. Click Continue and follow your device's prompt.

Add a passkey on each device you use regularly. Right after signing in, AutoPhish may also offer Set up passkey – choose Not now to hide the prompt for 30 days.

Sign in with a passkey: On the login page, click Sign in with passkey and confirm on your device.

Rename or remove: Use Rename to give a passkey a recognisable name (e.g. "Work laptop"). Remove deletes it after you confirm your password.

Change your password

Under Change Password, enter your current password and the new one twice, then click Update Password. Passwords need at least 8 characters including an uppercase letter, a lowercase letter, a number and a special character.

Turn two-step sign-in off (not recommended)

Open Turn off two-step sign-in (not recommended), enter your current password and confirm. You can switch it back on anytime with Turn on two-step sign-in.

Two-step sign-in is a personal setting. There is currently no company-wide setting that enforces it for all team members, so we recommend agreeing on it within your team.

Lost access?

• Lost the device with your passkey: Sign in with your password and the e-mail code, then remove the old passkey and add a new one.
• Forgot your password: Click Forgot Password? on the login page and follow the link in the e-mail. Resetting your password signs you out on all devices. Two-step sign-in and passkeys stay active.
• No access to your e-mail inbox either: Contact AutoPhish support.

Good to know

• Limit Owner and Admin roles to people who need them (see "Manage Users, Roles & Multi-Company").
• Never share sign-in codes with anyone.

Updated on: 27/10/2026