From Settings → My profile, open Security → Two-factor authentication → Manage. That opens the dedicated page headed Two-factor authentication. Enrolment is not mixed into the main settings save.
After you confirm your mailbox (first signup or a new team invite), email sign-in codes are already on. The next login asks for your password, then a code. An authenticator app is extra. Any enabled factor — email, authenticator, or a recovery code — satisfies the One more step screen. Do not turn a factor off to “fix” login.
Add an authenticator app
- Press Set up authenticator.
- Scan the QR code in Google Authenticator, Authy, 1Password, Microsoft Authenticator, or any TOTP app — or type the manual key.
- Enter the 6-digit code the app shows.
- Press Turn on authenticator.
Nothing changes until a valid code is accepted. A bad scan only means try again. Press Cancel setup if you need to start over.
Email codes
If email codes are not already on, press Set up email codes, enter your password, then enter the 6-digit message and press Turn on email codes. Codes expire in 10 minutes and work once. Press Send a new code (password required) if you need another. Use Send code to email on the sign-in One more step screen when you log in.
Recovery codes
The first time a factor lands, PayBlah shows Your recovery codes (ten codes) once. Copy or print them immediately. Each works once. PayBlah stores only a one-way hash and cannot show the same set again. Keep them where you can reach them without your phone.
- On the two-factor page, under Recovery codes, enter Your password.
- Press Generate new recovery codes.
- Save the new set. The previous set stops working at that moment.
When you sign in
- Enter email and password on Welcome back and press Log in.
- If any factor is on, you see One more step — not a finished session yet.
- Enter the app code, the emailed code, or a recovery code. Press Verify.
- Start again abandons that half-finished sign-in if it is not you.
A signed-in session lasts 2 hours of inactivity, and at most 12 hours from sign-in even if you keep working. There is no device list in the product.
Turning a factor off
These controls exist for people who still have access. They are not a way to recover a locked account, and they are not a recommendation to leave two-factor off.
- Turn off authenticator only needs your password and a current code (app, email, or recovery).
- Turn off email codes only needs the same proofs. It is refused while email codes are your only factor — add an authenticator first if you truly need to drop email.
- Turn off two-factor authentication needs your password and a current code, and it removes both factors. It is hidden and refused when PayBlah requires two-factor for the workspace.
If that workspace requirement is on, you cannot leave every factor off. You are sent to the two-factor page until a factor is set. That requirement is a PayBlah platform policy. It is not a plan upsell, and you cannot switch it from Settings. When the requirement is off, that is a launch posture — it is not a claim that leaving factors off is safer.
If you lose your phone
- Use a recovery code you already saved in the same One more step box, then generate a new set after you are in.
- A teammate Admin cannot clear your two-factor.
- If you have no codes and no other factor, contact support from another channel after you can prove you control the account. Do not send recovery codes in chat. Do not ask anyone to bypass or disable two-factor for you.
What this will not do
- It does not replace a strong password (at least 12 characters). Keep both.
- It does not mean two-factor stays off until you visit this page. Confirming your email turns email codes on.
- This article does not describe staff-only recovery tools or how a platform operator changes a workspace requirement.