Skip to content
Open appSchedule a pilot

Account Security

DayZero protects sign-in with two-step verification: after your password or Google sign-in, you enter a second code. New accounts are walked through setting it up at sign-up. For firm owners and admins it is also enforced: until the second step is verified in your session, the app asks you to set it up, and billing changes, staff invites, and API key creation are refused. This article covers setting it up and what to do if you lose access to your codes.

Key capabilities

  • Two ways to receive codes: an authenticator app (recommended) or SMS text messages
  • Backup codes to get in if you lose your phone
  • An optional passkey: where it is enabled for your account, a passkey sign-in counts as both steps
  • A guided setup page, One more step to keep your account secure, that returns you to where you were when you finish
  • A Two-factor authentication required reminder for firm owners and admins who have not set it up yet
  • A prompt when an action needs a second check, with Set up now and Not now
  • Request account recovery on the sign-in screens for people who are locked out
  • A reference number for each recovery request, and a person at DayZero who verifies you

How it works

Two-step verification is on by default for firm owners and admins (a firm can change the policy). When it is required and your session has not verified it, DayZero asks you to enrol, or to sign in again and enter your code. Setup happens once; after that, new sign-ins and sensitive actions ask for a code.

flowchart TD
  need["DayZero asks for two-step verification"] --> setup["Set up now"]
  setup --> method["Authenticator app or SMS"]
  method --> backup["Save your backup codes"]
  backup --> done["Sign in with both from now on"]
  need --> later["Not now: nothing you were doing is lost"]

How to use it

  1. If you see One more step to keep your account secure (at sign-up, or after DayZero starts requiring it), follow the setup card. It takes about a minute and sends you back to the page you were on.
  2. If you see Two-factor authentication required across the top of the app, or as a full-screen notice, click Set up two-factor. It opens the Security page of your account.
  3. Under Two-step verification, add an authenticator app, or choose SMS and give the phone number that should receive codes.
  4. Enter the 6-digit code it shows you, then keep the backup codes somewhere safe.
  5. You can open the same Security page any time from your account menu at the bottom of the sidebar (Manage account).
  6. If a dialog says Set up two-factor authentication first, choose Set up now. When you finish, DayZero confirms with "Two-factor authentication is on" and you can retry the action.
  7. On the full-screen notice, after setup you are signed out and asked to sign in again with your code. If it says Second factor not verified, sign in again and enter your code.

Pro tips

  • Choose an authenticator app such as Google Authenticator, 1Password, or Authy. It works without signal and is the most reliable option.
  • Save backup codes in a password manager, not only on the phone that holds your codes.
  • Signing in with Google only confirms the first step. You still enter the second code.
  • Prefer a passkey? Under the setup card, Prefer a passkey? offers Set up a passkey, and you can add one later under Passkeys on the Security page. If it says the passkey is saved but you still need a code method, set up the authenticator app or SMS once as well.
  • Set it up before you need to change billing or invite staff, so those tasks are not interrupted.
  • Choosing Not now closes the prompt without losing your work, but the action stays blocked until you enrol.
  • For SMS, the phone number is used only to text you codes.

In-depth guide

Which actions need a second check

  • Firm owners and admins (when the firm enforces it, which is the default): the whole app is held behind a verified session, and billing changes and staff invites are refused until it is. If the session has not completed it, the action is refused and the prompt above appears.
  • Everyone: creating or rotating an API key needs both factors verified in the session, and Clerk may re-ask for your password and code.
  • Long-lived API keys never count as verified, so make these changes in the app, not with a key.

Locked out? Request account recovery

If you lose your phone, your authenticator app, and your backup codes, use Request account recovery on the sign-in screen. The page is public and does not reset anything by itself.

Field Notes
Email on your DayZero account Required
Your full name Required
Company or firm Optional
What can't you use any more? Pick at least one: My phone, My authenticator app, My backup codes, The email inbox on the account, Something else
How should we reach you? Another email or a phone number. Required if you can't read the account's email
What happened? Optional, up to 2,000 characters

Click Send recovery request. You get a reference number that starts with AR; quote it if you contact support at support@ondayzero.com.

What happens next

  • A person at DayZero reviews the request, usually within one business day.
  • They contact you using details on the account, or the contact you gave, and confirm it is really you before changing anything.
  • DayZero never asks for your password or a verification code.
  • Once confirmed, two-step verification is reset and you set it up again at your next sign-in.
  • If the email belongs to an account, that mailbox is told a recovery was requested, so an owner who did not ask can react.

Edge cases

  • The confirmation looks the same whether or not the email belongs to an account, so the form cannot be used to find out who has one.
  • Requests are limited per person and per address; if you hit the limit, email support instead.
  • If the setup page is opened when you are already set up, it simply sends you back to the app.