Turn on two-factor authentication and add a passkey

Add a second check to your Mesy sign-in, so nobody can get in with your password alone. The check is a code from an app on your phone, or a passkey (your fingerprint, face or device PIN).

You set both up in Settings, on the Profile tab. To open Settings, click your name at the bottom of the sidebar.

Turn on two-factor authentication

You need an authenticator app on your phone, such as Google Authenticator, 1Password or Authy. To set it up:

1. On the Two-factor authentication card, click Enable two-factor authentication.
2. Type your Current password. If you sign in only with Google or Microsoft, you won’t see this, so go to step 4.
3. Click Continue.
4. Scan the QR code with your authenticator app. If it won’t scan, type in the key under “Can’t scan? Enter this key manually:”.
5. Click Continue.
6. Type the 6-digit code from the app into Verification code.
7. Click Verify.
8. Save your 10 recovery codes with Copy or Download. Each one gets you in once if you lose your phone.
9. Click Done. The card now shows Enabled and how many recovery codes you have left.

Keep the codes somewhere safe. Mesy shows them only once. When 3 or fewer are left, the card warns you to get a new set.

Set up two-factor authentication when your admin requires it

Your admin can require everyone to use two-factor authentication. If you’re an admin, see Require two-factor authentication to turn it on.

If you don’t have a second check yet, sign-in stops at a Set up two-factor authentication screen. It says “Your workspace requires two-factor authentication. Set it up to finish signing in.” To finish:

1. Choose Authenticator app or Passkey.
2. For Authenticator app, follow steps 4 to 9 of Turn on two-factor authentication. For Passkey, follow your browser’s prompt.

Mesy then signs you in. It doesn’t ask for your password again.

If your admin turns this on while you’re signed in and you don’t have a second check yet, Mesy signs you out within 30 minutes. You set up your second check when you sign in again. This also happens after you accept an invite to a workspace that requires it.

Sign in with your second check

Once two-factor authentication is on, Mesy asks for your second check on a screen titled Two-step verification. It appears after your password, or after you sign in with Google or Microsoft.

If you use an authenticator app:

• Type the code from the app into Verification code and click Verify.
• If you don’t have your phone, click Use a recovery code and enter one of your saved codes.
• If you’ve also added a passkey, you can click Use your passkey instead.

If you have a passkey but no authenticator app, the screen says “Confirm it’s you with your passkey to finish signing in.” Click Use your passkey and follow your browser’s prompt.

If you lose your phone and your recovery codes, see Sign in after losing your two-factor device.

Get a new set of recovery codes

Do this when you’re running low, or if someone may have seen your codes:

1. On the Two-factor authentication card, click Regenerate recovery codes.
2. Enter your Current password, or click Use an authenticator or recovery code instead and type a code from your app or a recovery code. If you have no password, Mesy asks for a code instead.
3. Click Regenerate.
4. Save the codes in the Your new recovery codes box with Copy or Download.
5. Click Done. The card shows 10 recovery codes remaining.

Your old codes no longer work.

Turn off two-factor authentication

1. On the Two-factor authentication card, click Disable.
2. In the box that opens, click Disable again.
3. Enter your Current password, or click Use an authenticator or recovery code instead and type a code from your app or a recovery code. If you have no password, Mesy asks for a code instead.
4. Click Disable. The card shows Enable two-factor authentication again.

Mesy stops accepting codes from your authenticator app and deletes your recovery codes. The Mesy entry stays in the app, so delete it there if you no longer want it. If you have a passkey, Mesy still asks for it when you sign in.

Add a passkey

A passkey lets you sign in with your fingerprint, face, device PIN or a security key (a small USB key you plug in). To add one:

1. On the Passkeys card, click Add a passkey.
2. In Name (optional), type a name you’ll recognise, such as “MacBook Touch ID”.
3. Click Create passkey.
4. Follow your browser’s prompt to confirm it’s you. The passkey now shows on the card, with the date you added it.

You can now sign in with your passkey alone. Adding a passkey also turns on the second check. When you sign in with a password, Google or Microsoft, Mesy asks for your passkey. This happens even without an authenticator app.

Sign in with a passkey

On the sign-in page, click Sign in with a passkey and follow your browser’s prompt. You don’t type your email, password or a code.

Rename or remove a passkey

On the Passkeys card, click Rename next to the passkey, type the new Name and click Save.

To remove one, click Remove, then click Remove again to confirm. Mesy stops accepting that passkey. It stays in your device’s password manager, so delete it there too if you no longer want it.

Link Google or Microsoft sign-in

If your Profile tab has a Sign-in methods card, it lists the Google or Microsoft accounts you’ve linked.

• To link one, click Link Google or Link Microsoft. Mesy opens that sign-in page, then brings you back to Settings.
• To remove one, click Unlink, then click Unlink again to confirm.

If you signed up with Google or Microsoft and have no password, the card also has a Set a password section. With a password, you can still sign in when Google or Microsoft sign-in isn’t working. To set one:

1. Type a password in New password.
2. Type it again in Confirm password.
3. Click Set Password. Mesy shows “Password set”.

The password rules are in Change your password.

If something doesn’t work

• If Verify says “Invalid verification code”, type the code your app shows now. The codes change every 30 seconds.
• If you see “Sign-in session expired”, you took more than 5 minutes on the code screen. Sign in again.
• If you see “Too many requests. Try again later.”, you entered too many wrong codes. Wait up to 15 minutes and try again.
• If a passkey button or option is missing, your browser doesn’t support passkeys. Try another browser or device. On the Passkeys card, Rename and Remove still work.
• If you see “This account verifies with a passkey, which this browser doesn’t support.”, sign in from a browser or device where your passkey is saved.
• If you see “Cannot remove your only sign-in method”, add another way to sign in, such as a password. Then remove the passkey or the Google or Microsoft account.
• If Mesy won’t let you turn off two-factor authentication or remove a passkey, it’s your only second check and your workspace requires one. Add another second check first, such as a passkey, or ask your admin.
• If you see “Invalid credentials” after using your passkey, your device couldn’t check your fingerprint, face or PIN. Sign in with your password, Google or Microsoft, then use the passkey as your second check.