Issues with two-factor authentication

Two-factor authentication (2FA)

Zestly supports time-based one-time password (TOTP) two-factor authentication for additional account security.

Setting up 2FA

• •Go to Settings → Security
• •Click Enable Two-Factor Authentication
• •Scan the QR code with an authenticator app (Google Authenticator, Authy, 1Password, or similar)
• •Enter the 6-digit code from the app to confirm setup
• •Save the backup codes shown — store these somewhere safe

"The code is invalid or expired"

TOTP codes are time-sensitive and expire every 30 seconds. This error usually means:

• •Your device's clock is not synchronised correctly
• •You're entering an old code that has already expired
• •You're using the wrong authenticator account (if you have multiple)

Fix your device clock:

• •On iPhone: Settings → General → Date & Time → turn on "Set Automatically"
• •On Android: Settings → General Management → Date and Time → turn on "Automatic date and time"
• •On Windows: Settings → Time & Language → Date & Time → "Sync now"

After syncing the clock, try the code again.

Lost access to your authenticator app

If you've lost your phone or deleted your authenticator app:

• •Use one of the backup codes you saved when setting up 2FA
• •Each backup code can only be used once

If you no longer have backup codes, contact hello@zestly.com.au from the email address on your account. We'll verify your identity and reset 2FA. This process takes 1–2 business days for security reasons.

Disabling 2FA

• •Go to Settings → Security
• •Click Disable Two-Factor Authentication
• •Enter a valid 2FA code to confirm

We recommend keeping 2FA enabled at all times, especially for accounts with access to client data.

2FA for team members

Admins can require all team members to set up 2FA from Settings → Security → Require 2FA for Team. Members will be prompted to set it up on their next login.