Session Duration
Why am I being logged out more often?
Cybercriminals have access to powerful new AI tools that make attacks faster, cheaper, and harder to spot — what once required a skilled hacker can now be done by almost anyone. By requiring staff to authenticate more frequently, we make it harder for unauthorized users to access to the platform.
Is this a setting I can turn off?
No this is not a setting, it’s a platform-wide security improvement that cannot be turned off. You can shorten the length of session in Manage Business > Security settings if you choose.
Two Step Verification
How many failed verification code entry attempts before you get locked out on the billing and merchant account pages?
We do not lock you out, we just won’t let you proceed with updating those pages without a successful two-factor authentication.
Do verification codes expire?
Yes, after 5 min.
How often will I be required to log in?
Dashboard: every morning (logged out every night at midnight)
Professional App: every Monday morning (logged out every Sunday night at midnight)
Duo App: no automatic log out
What are my options for receiving login verification codes?
If you have a US or Canadian phone number (country code +1) you can receive the code by text message or authenticator app of your choice. Okta or Google Authenticator app are two of the most popular authenticator apps for our customers. If you have an international number, your only option is to use the authenticator app.
If I set up two-factor authentication with text message, can I change to authenticator app? Or vice versa?
No, once a user has been set up with an authentication method, there is no way for them to change their authentication method.
I didn’t receive my code - what do I do?
Check your mobile signal and confirm the number is correct.
I have a new phone number. How do I update my verification method?
Update your phone number under My settings > Profile > Personal information.
Can require two-step verification for all staff?
Yes, you can turn on two-step verification for all staff at your business in Manage Business > Security.
I turned off two-step verification for my business. Why are staff still being required to sign in with a code?
Once a user has logged in with two-step verification, their account will keep two-step verification enabled even if the business no longer requires it. Users can disable two-step verification under My Settings if the business does not require it.
Can I require two-step verification only for specific users?
No. Right now, two-step verification can either be required for all staff at a business, or individual users can turn it on/off for their own accounts. If it’s required by the business, individual users cannot turn it off.
We encourage users with high levels of platform access (like Admins and Managers) to turn on two-step verification for their accounts, regardless of whether the business requires it for all staff.
What happens if I get a new phone? How do I update my authentication method?
If you get codes by text message and kept the same phone number, nothing changes. Codes will arrive on your new phone. Authenticator app codes don't automatically transfer to a new phone, so if you can no longer generate codes, reach out to support and we'll reset two-step verification for you. The reset signs you out of Dashboard and the Pro app and requires a password reset. On your next sign-in, you'll set up two-step verification again.