Multi-factor authentication

Multi-factor authentication (MFA) adds a second step when you log in to the Merchant Dashboard or Reseller Dashboard. After your password, you enter a 6-digit code from an authenticator app, further protecting your account. MFA is required for everyone who logs in with a password.

This guide explains how to:

• Set up MFA on your account.
• Log in with an MFA code.
• Understand what happens when MFA becomes required.

Set Up Multi-Factor Authentication

1. Click your name in the top-left of the dashboard.
2. Select Account Settings.
3. Click Configure MFA. The Setup multi-factor authentication page opens with a QR code.
4. Open your authenticator app and scan the QR code.
5. Enter your password in Current password.
6. Enter the 6-digit code from your app in Code.
7. Click Setup multi-factor authentication.

A success message will show when MFA is set up.

Note

• Can't scan the QR code? Copy the text code shown below it and paste it into your authenticator app instead.
• The code in your app changes every 30 seconds. Always enter the code that's currently showing.

Log In With an MFA Code

1. Enter your email address and password as usual.
2. When prompted, open your authenticator app.
3. Enter the 6-digit code currently showing in your app.
4. Click Sign in.

Note

• You may not be asked for a code every time you log in, for example, if you logged in recently. When you're asked, enter the code currently showing in your app.

When MFA Becomes Required

• If you haven't set up MFA yet, you'll be asked to set it up the next time you log in.
• If you haven't logged in for 90 days or more, or have never logged in, you'll be asked to reset your password by email first, then set up MFA.
• MFA can't be turned off. This applies to everyone, including account admins.

FAQs

Why is MFA now required?

MFA protects your account, and the payments and refunds you can make from it, if your password is ever stolen. It's also in line with payment industry security standards.

I log in with SSO. Do I need MFA?

No. If you log in with single sign-on (SSO), your identity provider handles sign-in security. If you log in with a password, MFA is required.

Which authenticator app should I use?

Any app that supports time-based one-time passwords (TOTP) works, including Google Authenticator, Microsoft Authenticator, 1Password and Authy. We recommend one that backs up or syncs your codes, so you can move to a new phone without losing access.

Can I use MFA on more than one device?

Yes, but only during setup. Scan the same QR code with each app or device you want to use. They'll all generate the same codes, so if you lose one, you can still log in with the other.

I'm changing phones. What should I do?

Move your codes to your new phone before you wipe the old one. Most authenticator apps have a transfer, export or sync option, so check your app's help for how. If you can't move your codes, follow the steps for a lost phone below.

I've lost my phone or my authenticator app. How do I log in?

Contact our support team at [email protected]. If your account is managed through a reseller, contact them instead. Once we've confirmed it's you, we'll reset your MFA. The next time you log in, you'll reset your password by email, then set up MFA on your new device.

Why was I asked to reset my password?

If you haven't logged in for 90 days or more, or have never logged in, we'll ask you to reset your password by email before you set up MFA. This keeps unused accounts secure.

My login doesn't work anymore. What happened?

If you didn't log in and set up MFA by the deadline in our email, your user was removed. Ask your account admin to invite you again. If there's no admin left on your account, contact [email protected], or your reseller if your account is managed through one.

Why is my code being rejected?

The most common cause is your phone's clock being slightly out. Make sure your phone's date and time are set automatically, and enter the code that's currently showing.

Does MFA apply to API access?

No. MFA only applies to logging in to the dashboard. API access uses your API credentials.

Will Fat Zebra ever ask for my MFA code?

No. We'll never ask for your MFA code by email, phone or chat. If anyone does, don't share it. We may email you to reset your password or to confirm your MFA was reset. These emails never ask for your code.

Summary

You can now set up MFA and log in with a code from your authenticator app. You'll know setup worked when you see the success message.

Related guides

• Users
• Invite users
• Users and SSO