Account & Security: Two-Factor Authentication (2FA)

Two-factor authentication is available on every customer account and is optional: you choose whether to turn it on. You can use an authenticator app, and once that is set up you can also add a passkey (Face ID, Touch ID, Windows Hello, your phone, or a security key) for faster sign-in.

Turning It On #

You will need an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator, 1Password, or Authy.

1. Open your Profile page from the dashboard.
2. Find the Two-Factor Authentication (2FA) section and click Set up next to Authenticator app.
3. Open your authenticator app and scan the QR code. If you cannot scan it, type in the code shown underneath instead.
4. Enter the 6-digit code your app now shows, then click Enable authenticator app.
5. Your recovery codes appear. Copy them and keep them somewhere safe, such as a password manager.

Keep your recovery codes safe. They are shown only once, and they are your way back into your account if you lose your phone. Anyone who has them can use them to sign in, so do not share them or leave them in an email or a shared document.

Adding a Passkey (Optional) #

A passkey lets you confirm your sign-in with your fingerprint, face, screen lock, or a security key instead of typing a code.

You must set up the authenticator app first. The app (and its recovery codes) is your backup if you ever lose the device your passkey is on. Until it is set up, the Add passkey button is switched off and the page tells you why.

1. Set up the authenticator app (see above).
2. On your Profile page, go to Two-Factor Authentication (2FA) and click Add passkey.
3. Give it a name (for example "Work laptop"), enter your account password, and follow the prompt from your device.

You can add more than one passkey. To remove one, click Remove a passkey and confirm with your password. Removing a passkey signs you out of your other devices (this one stays signed in), in case the passkey was on a lost device. We email you whenever a passkey is added or removed.

While you have at least one passkey, the authenticator app cannot be turned off. Remove your passkeys first if you need to turn it off.

A passkey only works on the website address where you created it. If you sign in on more than one address (for example your agency's own branded address and the main NovaReps address), a passkey made on one will not appear on the other. There you will see "You have no passkey for this site". Just use your authenticator app (or a recovery code) instead. You can add a separate passkey on each address.

Signing In With It Turned On #

1. Enter your email and password as usual.
2. If you have a passkey, your device offers it automatically. Confirm with your fingerprint, face, screen lock, or key. If it does not pop up, click Use passkey. Prefer your app? Click Use authenticator app instead.
3. Otherwise, enter the 6-digit code from your authenticator app. The code changes every 30 seconds or so. (If you have both, you can switch with Use a passkey instead, and you can choose which one is shown first from Default sign-in method on your Profile page.)

If you do not have your phone or passkey, click Use a recovery code instead, enter one of your recovery codes, and sign in. Each recovery code works only once.

Lost or New Phone #

If you still have a recovery code:

1. Sign in with your email and password, then use Use a recovery code instead to get in.
2. Open your Profile page and go to Two-Factor Authentication (2FA).
3. Click Turn off, confirm with a recovery code, then click Set up again to link your new phone and get a fresh set of recovery codes.

Tip: if you still have your old phone, set up the new one before you get rid of the old one. While you are signed in you can also click Regenerate recovery codes to get a new set. Your old codes stop working immediately, so save the new ones.

Lost Your Phone and Your Recovery Codes #

You cannot sign in without a code or a recovery code, so you will need help from our team. Contact NovaReps support and ask for two-factor authentication to be reset on your account. A reset removes your authenticator app, recovery codes and all your passkeys. If your account was set up for you by an agency or service provider, contact them instead: they manage your account and can pass your request on.

Once it has been reset, you sign in with just your email and password, and you can set up two-factor authentication (and passkeys) again from your Profile page. Keep your new recovery codes safe so you never need to do this again.

Signing In With Google or Microsoft #

If two-factor authentication is turned on (authenticator app or passkey), signing in with the Google or Microsoft button is not available for your account. You will see a message asking you to sign in with your email and password instead, then you complete the second step as usual.

If you created your account with Google or Microsoft and never chose a password, you will be asked to set a password first before you can turn two-factor authentication on. On your Profile page, click Email me a link to set a password and follow the link we send you. This makes sure you always have a password to sign in with.

Turning It Off #

1. Open your Profile page and go to Two-Factor Authentication (2FA).
2. Click Turn off next to Authenticator app.
3. Enter the 6-digit code from your app (or use a recovery code) and confirm.

If you have passkeys, remove them first (Remove a passkey). The Turn off button for the authenticator app appears once they are gone.

We email you whenever two-factor authentication is turned off, so you will know if anyone else does it.

Related Articles #

• Account & Data: Exporting Data & Account Deletion