Turn on two-step verification

Two-step verification adds a 6-digit code from an authenticator app to your sign-in. After you enter your password, Tavala asks for the code before it signs you in. It needs an account.

Turn it on

1. Open SettingsSign-in & security. On a phone, Settings is the round person icon at the top right. On an iPad or a Mac it is at the foot of the rail or the sidebar.
2. Under Authenticator app, tap Set up an authenticator app. Your device may ask you to confirm it is you first, with Face ID, your fingerprint, your passcode or, in a browser, a passkey.
3. Open an authenticator app on your phone, such as 1Password, Google Authenticator or Microsoft Authenticator, and scan the QR code on the screen. If you cannot scan it, tap the copy button next to "Can't scan it? Enter this key:" and paste the key into the app.
4. Save the same key in a second app or in your password manager. This is the only backup. See If you lose the app.
5. Enter the 6-digit code the app shows and tap Turn on.
6. Tavala says "Authenticator app is on. Signing in on a new device now asks for its code." The page now shows Authenticator app with "On since" and the date.

If the code is refused, Tavala says "That code didn't work. Check the time on your phone and try again." Authenticator codes depend on the clock, so check that your phone's time is set automatically. After too many tries, wait a minute.

Signing in afterwards

1. Enter your email and password, or use a passkey, as usual.
2. The Two-step verification screen asks "Enter the 6-digit code from your authenticator app."
3. Type the code and tap Verify.

Nothing moves or syncs until the code is accepted. If you tap Cancel or go back, the sign-in ends and the device stays a guest with the data it already had.

The code is also asked when you reset a forgotten password. Tavala asks for it after the emailed code and before you choose the new password.

If you lose the app

There are no recovery codes. Two things can get you back in:

• The same key in a second app. If you saved the key in another authenticator app or in a password manager, use the code from there.
• Support. If not, tap Lost your authenticator app? on the Two-step verification screen, then Email support, and write from your account's email address. Tavala confirms it is you and helps you back in. See contact support.

Save the key when you set the app up. On an iPad or a Mac the authenticator usually lives on your phone, so keep the key somewhere that does not depend on that phone.

Turn it off

1. Open SettingsSign-in & security.
2. On the Authenticator app row, tap Remove.
3. In the sheet Remove the authenticator app?, tap Remove. Signing in on a new device will ask only for your password again.
4. Your device confirms it is you. If you signed in before the app was added, Tavala may also ask for a code from the app you are removing, in a sheet titled Enter your code.
5. Tavala says "Authenticator app removed."

Good to know

• It does not ask when you are already signed in. Your device keeps its session. The code is asked when you sign in with your password or a passkey, which means on a new device, after you sign out, or after you reset the password.
• Connecting a bank never accepts the code. That check uses your device or a passkey. See passkeys.
• Adding or removing a passkey can ask for a code first, when your current session has not given one yet.
• It belongs to the account, not to one device. The same code is asked on every device.
• Not for guests. A guest has no account to protect. Guests can still use the app lock.