> ## Documentation Index
> Fetch the complete documentation index at: https://help.hoopai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Two-factor authentication

> Enable two-factor authentication (2FA) on your account and enforce it across your team to protect against unauthorised access.

Two-factor authentication (2FA) adds a second verification step to the login process. Even if an attacker obtains a password, they cannot log in without also having access to the second factor — typically a code delivered to a phone or generated by an authenticator app.

HoopAI supports 2FA at the individual user level and allows administrators to require it across all team members.

***

## Enabling 2FA on your own account

<Steps>
  <Step title="Open your profile settings">
    Click your name or avatar in the bottom-left corner of the sidebar and select **Profile Settings**, or navigate to **Settings > My Profile**.
  </Step>

  <Step title="Find the security section">
    Scroll down to the **Security** or **Two-Factor Authentication** section on the profile settings page.
  </Step>

  <Step title="Choose your 2FA method">
    Select one of the two available methods:

    * **SMS (text message)** — a one-time code is sent to your registered mobile number each time you log in
    * **Authenticator app** — use an app such as Google Authenticator, Authy, or Microsoft Authenticator to generate time-based codes that refresh every 30 seconds

    The authenticator app method is more secure because it does not rely on mobile carrier infrastructure and works even when you have no cell signal.
  </Step>

  <Step title="Complete verification">
    After selecting your method, you will be prompted to verify the setup:

    * **SMS**: Enter the code sent to your phone number to confirm it is correct
    * **Authenticator app**: Scan the QR code displayed on screen using your authenticator app, then enter the 6-digit code shown in the app to confirm the pairing
  </Step>

  <Step title="Save backup codes">
    After enabling 2FA, HoopAI generates a set of single-use backup codes. **Save these in a secure location** (a password manager or printed and stored safely). You can use a backup code to access your account if you ever lose access to your phone.
  </Step>
</Steps>

<Warning>
  If you lose your phone and do not have backup codes, you will be locked out of your account. Contact HoopAI support to initiate an identity-verified account recovery. Recovery may take additional time.
</Warning>

***

## Setting up an authenticator app

If you choose the authenticator app method and do not already have an app installed, download one of these free options:

| App                     | Platform                   | Notes                            |
| ----------------------- | -------------------------- | -------------------------------- |
| Google Authenticator    | iOS, Android               | Simple, widely used              |
| Authy                   | iOS, Android, Desktop      | Supports cloud backup of codes   |
| Microsoft Authenticator | iOS, Android               | Good for Microsoft 365 users     |
| 1Password               | iOS, Android, Mac, Windows | Integrated with password manager |

Once installed, open the app and tap **Add account** or the **+** icon, then scan the QR code displayed in HoopAI.

***

## Requiring 2FA for all team members

Account Admins can force 2FA across all users. When this setting is active, any team member who tries to log in without 2FA enabled will be prompted to set it up before they can access the platform.

<Steps>
  <Step title="Open staff settings">
    Go to **Settings > My Staff**.
  </Step>

  <Step title="Find the security policy">
    Look for a **Security** or **2FA Policy** section at the top of the staff settings page. Some plans surface this under **Settings > Security**.
  </Step>

  <Step title="Enable the requirement">
    Toggle on **Require Two-Factor Authentication for all users**. Confirm the change when prompted.
  </Step>

  <Step title="Notify your team">
    Existing users who do not yet have 2FA enabled will be prompted to set it up the next time they log in. Send your team a heads-up so the prompt does not come as a surprise.
  </Step>
</Steps>

<Tip>
  Enforcing 2FA for your whole team is strongly recommended if your HoopAI account stores customer contact data, payment information, or any personally identifiable information (PII). It is also a prerequisite for HIPAA-compliant configuration.
</Tip>

***

## Disabling 2FA

If you need to disable 2FA on your account:

1. Go to **Settings > My Profile > Security**
2. Click **Disable Two-Factor Authentication**
3. Enter a verification code from your current 2FA method to confirm the change

<Note>
  If an admin has enforced 2FA across the account, individual users cannot disable it for themselves. The admin must first turn off the account-wide requirement before any user can opt out.
</Note>

***

## Resetting 2FA for a team member

If a team member loses access to their authenticator app or phone and cannot log in:

<Steps>
  <Step title="Log in as Admin">
    Access the account with your Admin credentials.
  </Step>

  <Step title="Go to My Staff">
    Navigate to **Settings > My Staff** and find the affected user.
  </Step>

  <Step title="Reset their 2FA">
    Click the three-dot menu next to their name and select **Reset 2FA** (or **Edit > Disable 2FA**). This removes the 2FA requirement for their next login, allowing them to re-enroll with their new device.
  </Step>

  <Step title="Ask them to re-enroll">
    Ask the team member to log in and set up 2FA again using their new phone or authenticator app.
  </Step>
</Steps>

***

## Frequently asked questions

<AccordionGroup>
  <Accordion title="Can I use SMS and an authenticator app at the same time?">
    No. HoopAI requires you to choose one method at a time. If you want to switch methods, disable your current 2FA setup and re-enable with the new method.
  </Accordion>

  <Accordion title="What if I don't receive the SMS code?">
    Check that your phone number on file is correct under **Settings > My Profile**. Also ensure you have cell signal or mobile data. If codes consistently fail to arrive, consider switching to an authenticator app which does not depend on your carrier.
  </Accordion>

  <Accordion title="Are backup codes single-use?">
    Yes. Each backup code can only be used once. After using a code, generate a new set under **Settings > My Profile > Security > Regenerate Backup Codes** to ensure you always have valid codes on hand.
  </Accordion>

  <Accordion title="Does 2FA affect API access?">
    No. API keys and webhook integrations authenticate separately and are not affected by 2FA settings on user accounts.
  </Accordion>

  <Accordion title="Is 2FA required for HIPAA compliance?">
    Yes. If you are using HoopAI in a HIPAA-compliant configuration, enforcing 2FA for all users is a required access control measure. See the [HIPAA compliance guide](/getting-started/hipaa-compliance) for full requirements.
  </Accordion>
</AccordionGroup>