---
title: Enrol a second factor
description: Set up an authenticator app or a passkey, keep recovery codes safe, and step up when an action asks for a fresh code.
order: 20
updated: 2026-09-16
keywords: 2FA, TOTP, authenticator, passkey, recovery codes, step-up, elevation
---

High-risk actions in ChowChirp ask for a second factor. This guide enrols one and explains the step-up prompt.

**Before you start:** you are signed in. Enrolment takes two minutes.

## Enrol an authenticator app

1. Open **Settings › Security**.
2. Under **Authenticator**, choose **Enrol**. A code and a scannable image appear once.
3. Scan it with Google Authenticator, Microsoft Authenticator, Authy or any app that supports one-time codes.
4. Enter the six-digit code from the app to confirm.

## Enrol a passkey

1. Under **Passkeys**, choose **Add passkey**.
2. Approve the prompt with Touch ID, Face ID, Windows Hello or your security key.

A passkey is the quickest way to step up on a phone or laptop you use every day.

## Save recovery codes

Generate recovery codes and store them somewhere safe. Each code works once and lets you in if you lose your phone. Regenerating codes requires a fresh step-up first.

## When you are asked to step up

Actions such as approving a payment run, changing the stock catalogue, revoking a device or approving support access open a dialog asking for a code or a passkey. Enter it and the action continues without losing what you were doing. The elevated session lasts five minutes; the most critical actions use a one-time proof bound to that single action.

> **Note:** Re-entering your password is not accepted as a step-up. You need an authenticator, a backup code or a passkey.

## Change or remove a factor

Removing a passkey, resetting the authenticator or regenerating recovery codes each ask you to verify with a **different** factor first. Sign out other sessions from the same screen.

## Related

- [Why approvals need a second factor](/docs/explanation/second-factor-approvals)
- [Roles and permissions](/docs/reference/roles-and-permissions)