MFA Enhancements — Device Remember & SMS Backup

    Overview

    Two-factor authentication (also called MFA) adds a second step to logging in, so that a password alone is not enough to access your account. It is mandatory for organisation administrators on Horsify. Riders and general users are not required to use it, but can turn it on if they wish.

    This guide covers three things:

    1. Setting up MFA with an authenticator app or SMS.
    2. Using "Remember this device for 28 days" so you don't have to enter a code every time you log in from your own computer.
    3. Saving and using your recovery codes.

    Setting Up MFA (First Time)

    The first time an organisation administrator logs in without MFA configured, Horsify takes you to the setup page automatically. Choose one of the two methods below.

    Option 1: Authenticator App (recommended)

    An authenticator app generates a fresh 6-digit code every 30 seconds. Free apps include Google Authenticator, Microsoft Authenticator, and Authy.

    1. On the setup page, choose Authenticator App.
    2. Scan the QR code with your authenticator app, or type the shown key into the app manually.
    3. Your app will start showing a 6-digit code. Enter that code to confirm setup.

    Option 2: SMS (backup)

    If you prefer, you can receive your codes by text message to an Australian mobile number.

    1. On the setup page, choose SMS.
    2. Enter your Australian mobile number (for example, 0412 345 678).
    3. Horsify sends a 6-digit code by text. Enter it to confirm.
    4. If the code doesn't arrive, use the resend option. SMS codes are valid for 10 minutes, and you can request up to 10 messages per day.

    You can set up SMS as a backup alongside an authenticator app, or use it on its own.

    Save Your Recovery Codes

    After your method is confirmed, Horsify shows a set of 10 recovery codes. These are single-use codes that let you get into your account if you lose access to your phone.

    • Write them down or store them somewhere safe (a password manager is ideal).
    • Each code works only once.
    • You must tick the box confirming you have saved them before you can finish.

    Setup is now complete and you are logged in.

    Logging In with MFA

    1. Enter your email and password as usual.
    2. If this device is already remembered, you go straight in — no code needed.
    3. Otherwise, you are asked for a verification code. You can:
      • Enter the code from your authenticator app, or
      • Switch to the SMS option and request a text code, or
      • Enter one of your recovery codes.
    4. Tick "Remember this device for 28 days" if you'd like to skip the code next time (see below).
    5. Confirm to finish logging in.

    Remember This Device for 28 Days

    When you enter a verification code, you'll see a "Remember this device for 28 days" checkbox. Tick it to tell Horsify this browser is trusted.

    • For the next 28 days, logging in from the same browser on the same device won't ask for an MFA code.
    • This trust is tied to that specific browser. Logging in from a different device, or a different browser, will still ask for a code.
    • The trust stays in place even after you log out — it applies to the device, not the session. After 28 days it expires and you'll be asked for a code again.

    Only tick this on a device that is genuinely yours. Don't use it on a shared or public computer.

    Managing Your MFA

    You can view your MFA status, generate a fresh set of recovery codes, or change your setup from your account security settings. Organisation administrators cannot remove MFA entirely, because it is a required protection for accounts that manage an organisation.

    Troubleshooting

    • My authenticator code is rejected. Codes are time-based — make sure your phone's clock is set to update automatically. Wait for a fresh code and try again.
    • My SMS code didn't arrive. Check you entered the right mobile number, wait a moment, and use resend. Remember there's a limit of 10 texts per day.
    • I've lost my phone. Log in using one of your recovery codes, then set up a new authenticator app or SMS number.
    • I've run out of recovery codes. Once logged in, generate a new set from your account security settings. Generating new codes replaces the old set.

    Related Features

    Published: