--- title: "Multi-factor authentication (MFA)" slug: "multi-factor-authentication" updated: 2026-08-18T08:03:32Z published: 2026-08-18T08:03:32Z canonical: "support.bookingtimes.com/multi-factor-authentication" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.bookingtimes.com/llms.txt > Use this file to discover all available pages before exploring further. # Multi-factor authentication (MFA) Multi-factor authentication (MFA) is enforced for all staff members as our ongoing commitment to system security and protection against phishing attempts (e.g. sending an email impersonating another business in order to try and gain access to that system) or other malicious attempts. Staff members will be prompted to re-authenticate each month (or if they log in from a different device, wi-fi network or IP/location combination). Staff can opt to use MFA Authenticators. These include: - **Authenticator apps**: including Google Authenticator, Microsoft Authenticator, Apple Passwords app, or other 3rd Party apps (that may charge) such as Duo (download via [https://duo.com](https://duo.com)) etc; - **Passkeys** on their device (e.g. Face ID, Touch ID etc); or - **Two-factor SMS** authentication (if didn’t receive please read Didn’t receive SMS here) High level admin staff members with the correct permission are also able to [manually authenticate staff](/v2/docs/multi-factor-authentication#manually-authenticate-staff-members) should they have any issues. ## **Adding multi-factor authentication** (MFA) ### Steps 1. When a staff member first logs in and they haven’t yet set up any MFA, they’ll see an **Add Multi-Factor Authentication** button on the dashboard and on their **My Profile** screen. 1. **Dashboard**: ![](https://cdn.document360.io/6926c75e-9b20-4216-bf9f-d7ca1df9c74f/Images/Documentation/Add Muts Factor Authenticar.png) 2. Staff **My Profile** screen: ![](https://cdn.document360.io/6926c75e-9b20-4216-bf9f-d7ca1df9c74f/Images/Documentation/Me Drive.png) 2. You will now be presented with the following 2 options: using an **Authenticator app**, or using a **Passkey** as part of their device’s built-in security. ![](https://cdn.document360.io/6926c75e-9b20-4216-bf9f-d7ca1df9c74f/Images/Documentation/• MY Dove(1).png) 3. If you select **AUTHENTICATOR APP**: 1. Follow the steps which begin with scanning the QR code. A few helpful links are also displayed: 1. Google Authenticator: [https://support.google.com/accounts/answer/1066447?hl=en&co=GENIE.Platform%3DAndroid](https://support.google.com/accounts/answer/1066447?hl=en&co=GENIE.Platform%3DAndroid) 2. Microsoft Authenticator: [https://www.microsoft.com/en-au/security/authenticator/mobile-app?ocid=authenticator_marketing_qrcode](https://www.microsoft.com/en-au/security/authenticator/mobile-app?ocid=authenticator_marketing_qrcode) 3. Duo: [https://duo.com/product/multi-factor-authentication-mfa/duo-mobile-app#download-duo-mobile](https://duo.com/product/multi-factor-authentication-mfa/duo-mobile-app#download-duo-mobile) ![](https://cdn.document360.io/6926c75e-9b20-4216-bf9f-d7ca1df9c74f/Images/Documentation/1. Scan the QR.png) 2. The authenticator app will prompt you to enter a details for you to save this login. This example screenshot shows Apple Passwords app on the left, and the Duo app on the right. ![](https://cdn.document360.io/6926c75e-9b20-4216-bf9f-d7ca1df9c74f/Images/Documentation/image-YJVLNQVM.png) 3. The authenticator app will then display a One-Time Code (a 6-digit code that changes every 30 seconds), that you then enter in back on your BookingTimes website and click the **Verify** button to complete the process. This example screenshot again shows Apple Passwords app on the left, and the Duo app on the right. ![](https://cdn.document360.io/6926c75e-9b20-4216-bf9f-d7ca1df9c74f/Images/Documentation/image-QKQMNWZX.png) 4. Once verification has been complete, you will be promoted to save your recovery codes in case you ever lose access to your authenticator app, and these single-use codes are the only way to sign in without another administrator. > [!WARNING] > **Save your recovery codes** > > Ensure you save those codes now as you won’t be able to see them again. Click **Complete** button once you’ve saved them. ![](https://cdn.document360.io/6926c75e-9b20-4216-bf9f-d7ca1df9c74f/Images/Documentation/image-EI90YC0N.png) 4. If you select **PASSKEY**: 1. Follow the steps which begin with adding a name for this passkey and click the **Add Passkey** button to continue. ![](https://cdn.document360.io/6926c75e-9b20-4216-bf9f-d7ca1df9c74f/Images/Documentation/DIONSONO BOCKNES COURSES SALES MARKETING SETUP.png) 2. You will now be prompted to choose how to manage your passkeys, please note this will look different **based on your device**. This example screenshot suggests the Apple Passwords app which also manages passkeys for Apple devices. Please follow the steps based on your device to complete this process. ![](https://cdn.document360.io/6926c75e-9b20-4216-bf9f-d7ca1df9c74f/Images/Documentation/MyDrIve.png) --- ## **Prompted to use multi-factor authentication** Once multi-factor authentication has been set up, staff will be required to complete MFA verification whenever re-authentication is triggered, such as each month as per our updated security requirements, or when accessing the system from a new device or different IP/location combination. ### Steps 1. The following screen will appear to prompt you to select your desired MFA verification method. If you have Passkey set up then use that now to complete the verification process. If you select the **Authenticator App** or **SMS** option, the authentication code will be sent (either displayed in your Authenticator app or SMS). ![](https://cdn.document360.io/6926c75e-9b20-4216-bf9f-d7ca1df9c74f/Images/Documentation/DASHIDARD BOCKNES COURS SALES MARTING 367-.png) 2. If an authentication code has been sent, enter it here and click **Verify**. ![](https://cdn.document360.io/6926c75e-9b20-4216-bf9f-d7ca1df9c74f/Images/Documentation/Account Authentication Required.png) --- ## **Manually authenticate staff members** High level admin staff that have the right permissions, are able to manually validate other staff connections if MFA is needed (though staff should be using the options available that our outlined in this article using Authenticator apps, Passkeys or two-factor SMS authentication). ### Steps 1. First, ensure the hight level admin staff as the correct permission "**Add Instructors & Set Roles**" (or “Staff” etc depending on what terminology has been set up for your system) to be able to manually authenticate other staff members. 1. Please refer to the [Security and permissions](/v2/docs/security-and-permissions) article for more details. ![](https://cdn.document360.io/6926c75e-9b20-4216-bf9f-d7ca1df9c74f/Images/Documentation/image-ZMWXFSIL.png) 2. Navigate to **Setup > Instructors & Admins > select staff member** 3. Click on the **key icon** under their email address ![](https://attachment.freshdesk.com/inline/attachment?token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZCI6MjA0MzY3NzAzNDExMywiZG9tYWluIjoiYm9va2luZ3RpbWVzLmZyZXNoZGVzay5jb20iLCJhY2NvdW50X2lkIjoxMTI0MDg3fQ.5XX0ZnpEgWIg4Tn6_gLp5GwFBaplLpC9N0_gdxIK7mI) 4. Under the **MFA** (Multi Factor Authentication) column, you can click on the **Shield icon with a +** in it to manually authenticate them. Once they've been authenticated on that browser/device/wifi network you will see the **Shield icon with a tick** in it. If the staff change wi-fi networks, devices, or their IP and location constantly changes, they may be prompted to re-authenticate. ![](https://attachment.freshdesk.com/inline/attachment?token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZCI6MjA0MzY3NzAzNTQxMywiZG9tYWluIjoiYm9va2luZ3RpbWVzLmZyZXNoZGVzay5jb20iLCJhY2NvdW50X2lkIjoxMTI0MDg3fQ.11dQPKsUdRoKHBWsPfC78WYlbCcMt8nL83RcTLrGY70) --- ## **2 factor SMS authentication** This method will be used to initially authenticate any staff member. Please note these SMS text messages are charged, which is why we recommend staff then use either an Authenticator app or Passkey for future verification. > [!NOTE] > **SMS cost** > > Please note, there is a cost for sending these SMS, these cannot be turned off they are required as a core part of our system security. You can view the cost under **Setup** > **System Settings** > **Account Settings** and scroll down to SMS *Pricing*. ### Didn’t receive SMS? If the verification SMS was not received in a timely manner for any reason, but if you have someone with high-level access to the system you can either: - Manually authenticate the staff member as per the [Manually authenticate staff members](/v2/docs/multi-factor-authentication#manually-authenticate-staff-members) section above; or - Retrieve the SMS verification code as follows via the SMS Log report Please do contact support@bookingtimes.com if this issue persists or if you are the sole user of the system and can’t gain access. #### Steps 1. Navigate to **Reports > Logs section > Sent SMS** report 2. Find the phone number that was attempting to verify, and copy the **Verification Code** to give to the staff member attempting to log in 1. **Note**: this must be done in a timely manner before the verification code expires. ![](https://cdn.document360.io/6926c75e-9b20-4216-bf9f-d7ca1df9c74f/Images/Documentation/image-RF89WSDT.png)