What is two-step authentication (2FA)?
Two-step authentication (2FA) or two-factor authentication adds an extra layer of security to your Atoa account.
Along with your password, you'll need a one-time code each time you log in, either from an authenticator app or sent to
your phone via SMS. This helps protect your account and your payments, even if someone else knows your password.
Who needs 2FA?
- Account owners and admins: 2FA is mandatory and cannot be turned off
- Supervisors, cashiers, and custom roles: 2FA is not required. These users log in using a one-time code (OTP) sent to
their email or phone each time
How to set up 2FA?
You’ll be prompted to set this up when you log in.
- If you’re an existing user, you may see a prompt asking you to log out and create a password first
- Create a strong password to protect your account
- Once done, you’ll be guided through setting up 2FA
You can also set it up anytime from Security And Control in your account settings.
How does 2FA work?
When setting up 2FA, you can choose between two methods:
Option 1: Authenticator App (recommended)
- Download an authenticator app (such as Google Authenticator, Authy, or Microsoft Authenticator)
- Scan the QR code shown on screen, or copy the code below it and paste it manually into the app
- Your app will generate a 6-digit code. Enter this and click Next
- Once confirmed, 2FA will be enabled for your account
Option 2: SMS
- Enter your phone number (with country code) if you haven't already
- A 6-digit code will be sent to your phone via text message
- Enter the code and click Next
- If you didn't receive it, wait 60 seconds and tap Resend Code
Save your backup codes
Once you enable 2FA, you'll receive 10 backup verification codes. These are important.
- Use them if you lose access to your phone or authenticator app
- Without them, you'll need to contact support to recover your account
Tap Download or Copy to save them, and store them somewhere safe and separate from your phone.
Session timeout and trusted devices
If you're an owner or admin and haven't set up 2FA yet, you'll be automatically logged out after 60 hours and prompted
to complete 2FA setup before you can continue.
For supervisors, cashiers, and custom roles, sessions also expire after 60 hours, after which you'll need to log in
again using your OTP.
Once 2FA is set up, owners and admins can tick "Remember this device for 30 days" when logging in. This means you won't
be asked for a 2FA code on future logins from the same browser or device for 30 days.
What happens next?
Once 2FA is enabled:
- You'll log in using your password + a 6-digit code from your authenticator app or via SMS
- You'll need to enter a fresh code each time you log in (unless you've saved a trusted device)
How to switch your 2FA method?
If you're an employee, you can switch between SMS (OTP) and an authenticator app at any time. Go to Security And Control
→ Two-step verification → Manage → Change method and select your preferred method.
What if I lose access to my authenticator app?
If you've lost your phone or switched to a new one, you can still get back in.
Use a backup code on the 2FA screen during login, tap "Use a backup code" or "Can't access your code?" and enter one of
your saved 8-character backup codes.
Once you're in, go to Security And Control → Two-Step Verification → Manage to set up 2FA on your new device, and
generate a fresh set of backup codes.
If you're an employee and can't get back in, ask your account owner or admin. They can revoke your 2FA from the
dashboard so you can set it up again on your next login.
If you're an owner or admin and have lost access to your 2FA device or uninstalled your authenticator app, contact Atoa
Support. We'll verify your details and help you regain access.
2FA code not working?
If your 6-digit code keeps getting rejected, the most common cause is your phone's clock being slightly out of sync.
To fix this, go to Settings → Date & Time on your phone and make sure "Set automatically" is turned on. Then try again
with a fresh code.
How to change your password?
You can update your password anytime from your settings:
- Go to Security And Control
- Tap Change password
- Enter your current password and tap Send verification code
- You'll receive a one-time code (OTP) on your registered email or phone. Enter the 6-digit code
- Enter your new password, confirm it, and tap Update password
What happens when 2FA is made mandatory for employees?
If an owner or admin enables mandatory 2FA for the organisation, here's what to expect:
- New employees will be prompted to set up 2FA the next time they log in
- Employees who are already logged in won't be affected until their next login session
FAQs
I entered the wrong 2FA code. What happens?
You have 3 attempts to enter the correct 6-digit code. If you exceed this, you'll see:
"Too many incorrect attempts. Please try again later or reset your password."
My account is locked after too many wrong passwords. What should I do?
If you enter the wrong password 5 times in a row, your account is temporarily locked for 20 minutes. You can wait for
the countdown to finish, or reset your password straight away, which unlocks your account immediately.
What if I forget my password?
You can reset it from the login page:
- Tap "Forgot Password?" on the password screen
- Enter your email or phone number and tap Send Reset Code
- Enter the 6-digit code sent to your email or phone
- Choose a new password and confirm it
I didn't receive my reset code
Check your spam or junk folder if you don't see it in your inbox. If you're using SMS and still haven't received it,
make sure your phone has signal and the number on your account is correct.
My reset link expired
Reset links are valid for 15 minutes only.
If it expires:
- Start the reset process again from the login page
- We’ll send you a new link
Do I need to enter a code every time I log in?
Yes, once 2FA is enabled, you'll always need your password and a 6-digit code. The only exception is if you've saved a
trusted device, in which case you won't be prompted for a code on that device for 30 days.
