Setting up two-factor authentication

Two-factor authentication (MFA) is required for every CartonCrew account. After you sign in, you also enter a 6-digit code from an authenticator app on your phone.

Who this is for: anyone with a CartonCrew account, the first time they sign in and every time after.

Setting it up (first sign-in)

1. Install an authenticator app on your phone if you do not have one (Google Authenticator, Microsoft Authenticator, 1Password or Authy all work).
2. Sign in (see Signing in). The page “Set up two-factor authentication” opens.
3. In your authenticator app, add an account and scan the QR code on the page. If you cannot scan it, click Can’t scan? Enter code manually and type the code shown into the app instead.
4. Under Save your recovery codes, click Download codes (or copy them somewhere safe). They are shown only once. Then tick I have saved these recovery codes somewhere safe. You cannot continue until you do.
5. Type the code your app is showing into 6-digit code and click Verify and continue.

Every sign-in after that

The page “Enter your two-factor code” opens after you sign in. Open your authenticator app, type the current code into 6-digit code, and click Verify.

Signing in with a recovery code

If you do not have your authenticator app, you can use one of the recovery codes you saved during setup.

1. On “Enter your two-factor code”, click Use a recovery code.
2. Type one of your saved codes into Recovery code. It looks like abcde-12345. You can leave out the hyphen. Letters must match the upper or lower case of your saved code.
3. Click Use recovery code.

Each recovery code works only once. Cross it off after you use it. To go back to the 6-digit code, click Use your authenticator app instead.

Once you are in, if your authenticator app is gone for good, set up a new one (see “You lost your phone or authenticator app” below). Setting up again gives you a new set of recovery codes, and the old ones stop working.

What you’ll see

Common issues

• The code is rejected. Codes change every 30 seconds; wait for a new one and type it straight away. If it keeps failing, turn on automatic date and time on your phone.
• You lost your phone or authenticator app. Sign in with a recovery code (see above). If the page shows Can’t access your authenticator app?, click it and then Reset and sign out. You are signed out, and you set up a new authenticator the next time you sign in. If you have no recovery codes left and that link is not on the page, ask an Owner of your organization to reset your two-factor authentication for you.
• A recovery code is refused. Each code works once, so a code you already used is refused. Check the upper and lower case letters and try another code.
• “Too many attempts”. After several wrong codes (6-digit or recovery codes, counted together) you must wait about 15 minutes, or sign in again to get a new prompt.
• You want to move to a new phone or app. Set the new app up from the same steps after a reset, as above.

Last updated: 2026-09-25 · Applies to: CartonCrew v1.691.1+