Important: This feature is not live yet. This article has been published to help you prepare for the setup before launch. All PocketSuite users will be notified when it's time to set up MFA! 

Multi-Factor Authentication (MFA) adds a quick verification step when you sign in, so only you can get into your account. It’s one of the simplest ways to keep your business, your client information, and your payouts safe.

Before you start

• Verify your login email first. We’ll suggest one based on the email already on your account, and you can change it to a different one if you prefer. Learn more about login emails below. 
• Have your phone nearby. You’ll use it to receive a one-time code via SMS when you sign in. You can also choose to get it by email.
• Have access to the email address on your account. PocketSuite sends a verification code there during setup.

Note: MFA is required for every PocketSuite account to sign into the app. If you use a 4-digit passcode, it’s being replaced by a password. Once your setup is complete, the passcode no longer works. Your clients will not be required to use multiple factors to checkout of online booking or complete other actions sent to them over text.

How to set up MFA

If MFA isn’t set up on your login yet, you’ll see a banner in the app with a Set Up Now button. You can also start from your account settings. You need to be on the latest version of the app to get set up. 

1. Tap the banner in the app, or open the account switcher and choose Login, Security & User Settings.
2. Tap Set Up Now.
3. Add a password for your account.
4. Enter the verification code we send to your email address.

That’s it. Setup only takes a couple of minutes.

Note: Each person who signs in to PocketSuite sets up MFA on their own login, using their own phone number. If you have team members, ask each of them to complete these steps.

How signing in works

After setup, signing in takes two quick steps: enter your password, then enter the one-time code sent to you by SMS or email.

Passkeys

After setup, signing in takes two quick steps: enter your password, then enter the one-time code sent to you by SMS or email.

What a passkey does

• Signs you in on its own. On the sign-in screen, tap Sign in and your device prompts you for your passkey. You don't need to enter your phone number or a one-time code.
• Speeds up confirmations. When PocketSuite asks you to confirm it's you before an important action, your passkey is used first. If it doesn't work, you can confirm with a one-time code (SMS or email) instead.
• Works alongside your password. At least every 30 days, you'll be asked for your password or a one-time code along with your passkey. We count the 30 days for each passkey separately.
• Is always optional. A password and a one-time code always work, so you can sign in without a passkey.

Note: The identification is based on a token tied to your device or your device’s ecosystem (most commonly iCloud on Apple devices and Google and Android devices and Chrome browsers), providing the most secure method of verification available. Learn more about what passkeys are and how they work here.

Add a passkey

You'll need a password and a verified email on your account first. If either is missing, PocketSuite tells you what to finish before you can continue.

1. Open the account switcher and choose Login, Security & User Settings.
2. Tap Passkey, then Add a passkey.
3. Confirm it's you with your password, a text code, and an email code.
4. Follow your device's prompt to create the passkey.

PocketSuite sends you a security notice by text and email whenever a passkey is added or removed. If you receive this notice and didn't make the change, contact security@pocketsuite.io right away.

Manage your passkeys

• See what you've added. The Passkey screen lists each passkey with its provider, such as iCloud Keychain or Google, and the date you added it.
• Remove a passkey. Tap the passkey, then remove it. You'll be asked to verify with a code before it’s removed.

Note: Older phones can't use passkeys. Devices running Android 9 or below, or iOS 15.6 or below, can still sign in with a password and one-time code but can't add a passkey. If you use PocketSuite’s desktop site, you’ll still have the option to sign-in via a mobile passkey using a QR code.

Setting up your team

Every team member signs in with their own login, so everyone sets up MFA for themselves. Give each person their own login instead of sharing one, and have them follow the steps above.

Setting up on the desktop (Good for virtual assistants and team members.)

If you or a team member signs in on a desktop computer, you can finish setup there. From November 7 to November 14, team members abroad can use an existing 4-digit passcode instead of a one-time code to set a password or verify their email.

1. Sign in on desktop and enter your phone number.
2. Enter the one-time code we send you.
3. Confirm and verify your email address.
4. Add a password. A passkey is optional.

Email and verification notes

• Use your login email. The verification code during setup goes to the login email on your account. Make sure you can open it before you start. Business owners can confirm or update it in Login, Security & User Settings.
  • What it’s used for. Your login email is only used to receive verification codes and security alerts, and to reset your password.
  • It’s separate from your profile email. The email in Settings > Profile is used for general account communication and data exports, and it appears on your Invoice, Estimate, and Receipt PDFs.
• If more than one person shares the same email, they will need to choose a unique email address for multi-factor authentication, so they can each receive their own codes. Email aliases or plus addresses (name+tag@domain) are accepted.  
• Check your spam folder. If the verification email doesn’t show up within a few minutes, look in spam or junk, then ask for a new code.
• Codes expire after 5 minutes. If a code stops working, request a new one and enter the latest code.

Special situations

• Clients and Payees: Set up MFA with your own login and your own phone number. You’ll receive one-time codes by SMS at sign-in. You can optionally use email once the email is verified.
• Business owners and team members: Each team member sets up MFA on their own login. Add team members from your account so everyone has their own login.
• Virtual assistants and team members outside the U.S.: Sign in on desktop and enter your phone number to receive the one-time code. If a code doesn’t arrive, tap Resend Code or Call Me Instead, or email support@pocketsuite.io. Verify the login email with an email address available to the team member and set a password right away to ensure they have consistent access.

Frequently Asked Questions 

I didn’t get my one-time code. What should I do?

Check that you entered the phone number on your account, then tap Resend Code or Try Another Way. If the code still doesn’t arrive, email support@pocketsuite.io and we’ll help. We strongly recommend setting up passkeys to make sign-in as quick and easy as possible.

Do I have to add a passkey?

No. A password and a one-time code at sign-in are all you need. A passkey is an optional alternative providing both greater convenience and security.

Why is PocketSuite adding MFA?

Online security matters more every day, and MFA is a widely used way to protect accounts. We’re taking this step to help keep your information safe.

Where can I get live help?

Join an Office Hours session with the PocketSuite Professor for a walkthrough of setup and a chance to ask questions.

If you have questions, reach out to our support team at support@pocketsuite.io.