FixedFixed: an invoice would not take payment again after a payment was deleted

Two-Factor Authentication

5 min read

Published September 4, 2026

What Two-Factor Authentication Adds

Without it, your password is the only thing between someone and your shop's repairs, customer records and takings. With it, a password on its own is not enough: signing in also needs a six digit code that changes every 30 seconds and only exists on your phone. Any of the four roles can turn it on, on any plan.

Turning It On

You need your phone and an authenticator app installed before you start.

  1. Click your avatar in the top-right header and select 'Profile'.
  2. Find the Two-factor authentication panel.
  3. Type your password and click 'Set up two-factor'.
  4. Scan the QR code with your authenticator app. If the phone cannot scan, type the key shown underneath it into the app by hand.
  5. Type the six digit code the app is showing and click 'Turn it on'.

Warning

If the code is refused, check the clock on your phone. A phone whose time is a minute out will make codes Fixmo cannot match.

Saving Your Recovery Codes

The moment two-factor is on, Fixmo shows ten recovery codes. This is the only time they are shown. Each one signs you in once, and they are what gets you back in when your phone is lost, broken or wiped.

  • Print them, or write them down, and keep them away from the phone running the authenticator app.
  • A password manager is fine, as long as it is not one that needs the same phone to open.
  • Your Profile page shows how many you have left, never the codes themselves.
  • Running low? Enter your password and a live code in Profile and click 'New recovery codes'. The old ten stop working.

Warning

Storing the recovery codes only on the same phone as the authenticator app defeats them. Losing the phone would then lose both.

Signing In With a Code

After two-factor is on, signing in has a second step.

  1. Enter your email and password as usual.
  2. Fixmo asks for a six digit code instead of signing you in.
  3. Open your authenticator app and type the code it is showing for Fixmo.
  4. If you do not have your phone, type one of your recovery codes in the same box instead.

Turning It Off

Turning it off needs your password and a live code together, so that someone who has borrowed your open session cannot quietly remove it. A recovery code works in place of the live code if your phone is gone.

  1. Open Profile and find the Two-factor authentication panel.
  2. Click 'Turn off'.
  3. Enter your password, and a code from your app or one recovery code.
  4. Click 'Turn it off'. Every session on the account is ended and you are signed in again on this device.

Signing Out of Every Device

A phone left in a taxi, a shared till nobody signed out of, a member who has left: all of them are the same problem, and 'Sign out everywhere' is the answer. It ends every session on your account immediately, on every device, including the one you are using.

  1. Open Profile and scroll to 'Signed in somewhere you should not be?'.
  2. Click 'Sign out everywhere'.
  3. Sign in again on the devices you still have.

Note

Changing your password does the same thing, and so does turning two-factor on or off. If an admin deactivates a member in Team, that member's next request fails on every device without anyone having to do this.

Frequently asked questions

All four. Admin, Manager, Technician and Cashier can each turn it on for their own account from Profile. It is per person, not per shop, so one member can use it while another does not, and it is available on every plan including Free.

No. Once two-factor is on for your account, every sign-in asks for a code and there is no skip. The only way in without your authenticator app is one of your recovery codes.

Any app that makes standard six digit TOTP codes. Google Authenticator, Microsoft Authenticator, Authy, 1Password and Bitwarden all work. Scan the QR code on the setup screen, or type the key underneath it if you cannot scan.

Use one of the ten recovery codes you were given when you turned it on. Each works once. Enter it in the code box at sign-in instead of a six digit code. Once you are in, go to Profile and either turn two-factor off or set it up again on the new phone, then make a fresh set of recovery codes.

Open Profile and click 'Sign out everywhere'. Every session on the account ends immediately, on every device, including the one you are using. Changing your password does the same thing.

Seven days, then you sign in again. It can end sooner: signing out everywhere, changing your password, turning two-factor on or off, and being deactivated by your admin all end every session on the account at once.