> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qlero.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Requiring multi-factor authentication

> Require team members and payee users to use an authenticator app before they can open your record company, and what they see until they do.

Multi-factor authentication adds a code from an authenticator app to every sign-in, so a stolen password isn't enough on its own. Each record company decides separately whether its team members and its payee users must use one. Both requirements are on for every record company unless you turn them off.

> [!NOTE]
>
> You need write access to record company settings, and your own account must have an authenticator app before you can change either switch. See [Your password and multi-factor authentication](https://docs.qlero.io/labels/getting-started/account-security.md).

## Change the requirement

**1. Open the settings**

Open **Record Company Settings › General › Configurations** and find **Security**.

**2. Set up your own authenticator app first**

If your account has none, both switches are locked and an info box offers **Set up authenticator app**. Scan the QR code with your app and enter the six-digit code it shows. The switches unlock as soon as you've finished.

**3. Choose who it applies to**

**Team Members** covers everyone with access to this record company, including people with organisation-wide access. **Payee Users** covers everyone who opens one of this record company's payees in the Artist Portal. When you view a payee from Qlero yourself, the team member requirement applies to you, not the payee one.

**4. Save**

Select **Save Changes**. The change applies immediately and is recorded in the audit log.

## What users see

**Required.** A team member or payee user without an authenticator app sees **Multi-Factor Authentication Required** instead of the record company or payee, with **Set up authenticator app**, **Switch company** and **Sign out**. The page opens as soon as they've set one up, without signing in again. Their access to other record companies and payees isn't affected.

**Not required.** Qlero still suggests it. After every sign-in, a user without an authenticator app is asked to set one up and can choose **Skip for now**.

Either way, once someone has an authenticator app, every sign-in asks for its code, whichever record company or payee they open afterwards.

## Turning it off

Switch it off and select **Save Changes**. Anyone locked out gets in straight away. Nobody's authenticator app is removed: users who already have one keep entering a code at every sign-in, and can remove it themselves under **Profile › Security**.

> [!WARNING]
>
> A user who removes their own authenticator app while the requirement is on is locked out of this record company again until they set one up.

## If someone loses their authenticator app

You can't reset it for them, and neither can they. They need to contact Qlero support at `support@qlero.io` from the address they sign in with.

## Next steps

* Manage your own password and authenticator app in [Your password and multi-factor authentication](https://docs.qlero.io/labels/getting-started/account-security.md).
* Invite the people the requirement applies to in [Adding team members](https://docs.qlero.io/labels/getting-started/adding-team-members) and [Adding payee users](https://docs.qlero.io/labels/agreements/adding-payee-users.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.