Two-Factor Authentication
Two-factor authentication (2FA) adds a second step to signing in to YellowPOS: a 6-digit code from an authenticator app on your phone. It works whether you sign in with a password or with Google, it is optional and off by default, and it is included in every plan. This guide shows how to turn it on, what signing in looks like afterwards, and what to do if you lose your phone.
1. Turn it on
Open your Profile and go to the Settings tab. The Two-Factor Authentication section sits between Change Password and Deactivate Account.
- Click Enable. A QR code appears.
- On your phone, open an authenticator app (Google Authenticator, Microsoft Authenticator, Authy, or 1Password) and scan the QR code. If you can't scan it, type the key shown under the code.
- Enter the 6-digit code the app shows and click Confirm and enable.
- Copy your 8 recovery codes and keep them somewhere safe. They are shown once.
Two-factor authentication isn't active until you confirm the first code, so nothing changes if you start and then cancel.
2. What signing in looks like
Sign in the way you always do: email and password, or Continue with Google. Before you reach the dashboard, YellowPOS asks for a code. Open your authenticator app, type the current 6-digit code, and you're in. Codes change every 30 seconds.
The code screen guards the whole admin area, including the POS, so there is no side door. Too many wrong attempts in a minute are temporarily blocked.
3. Trust this device
On the code screen you can tick Trust this device for 30 days. That browser then skips the code for 30 days, which is handy for the computer at your counter. Leave it unticked on shared or public computers. Turning two-factor authentication off and on again ends the trust everywhere.
4. Recovery codes
If your phone is lost, broken, or reset, a recovery code gets you in. Type it into the code box instead of the 6-digit code. Each code works once, and you have 8. The Settings tab shows how many are left, and you can create a fresh set (which cancels the old ones) by entering a current code.
- Store them somewhere other than your phone: a password manager, or a printout in a safe place.
- Don't send them to yourself over WhatsApp or email, where anyone with access to that account could read them.
5. Turning it off
In the same section, enter a current code (or a recovery code) and click Disable two-factor authentication. Asking for a code first means someone at your unlocked computer can't switch it off for you.
6. Lost your phone and your recovery codes?
Contact us on WhatsApp from the help button in the app. After we confirm it's really you, we can switch two-factor authentication off for your account so you can sign in and set it up again with your new phone.
What it does not do
- It doesn't send SMS codes, and it doesn't support hardware security keys.
- It can't be forced on for your staff yet. Each person turns it on for their own account.
- It doesn't affect your customers. It protects the people who sign in to run the business.
Using it well
Turn it on first for the accounts that can see and change the most: the owner and any admins. Pair it with a separate login for each staff member, which the activity log relies on. For why a second step matters even with Google sign-in, read what two-factor authentication is and whether your business needs it, and for a careful setup routine see how to set up 2FA without getting locked out.
Frequently asked questions
What is two-factor authentication in YellowPOS?
A second step after you sign in. Once it's on, YellowPOS asks for a 6-digit code from an authenticator app on your phone, in addition to your password or Google sign-in. Someone who only knows your password, or who gets into your Google account, still can't open your business.
Does it work if I sign in with Google?
Yes. Google sign-in and password sign-in both stop at the code screen once two-factor authentication is on. Google sign-in does not skip it.
Is it required?
No. It is optional and off by default, and it is set per person. Turning it on for yourself changes nothing for your staff, and your staff turning it on changes nothing for you.
Which apps can I use?
Any authenticator app that supports standard time-based codes: Google Authenticator, Microsoft Authenticator, Authy, 1Password, and similar. YellowPOS does not send SMS codes.
What if I lose my phone?
Use one of your recovery codes on the code screen. Each one works once. If you have no recovery codes left, contact us and an administrator of the platform can switch two-factor authentication off for your account so you can sign in and set it up again.
What does 'trust this device for 30 days' do?
It skips the code on that browser for 30 days, so you aren't asked every time you open the POS on your own computer. Don't tick it on a shared or public computer. Turning two-factor authentication off, or on again, ends the trust on every device.
Can I turn it off later?
Yes. Enter a current code or a recovery code on the same screen and click Disable. Requiring a code means someone who sits down at your open session can't simply turn it off.
Does it cost anything?
No. Two-factor authentication is included in every YellowPOS plan and uses a free authenticator app.