Sign-in security & 2FA

Goal: add an extra layer of protection to logins with email-based two-factor authentication (2FA), so a stolen password alone is not enough to sign in.

How email 2FA works

When 2FA applies to a login, FrameCourier adds one step after the email and password are accepted:

The user signs in with their email and password as usual.
FrameCourier emails a 6-digit verification code to that account's email address and shows a verification screen.
The user enters the code to finish signing in.

Codes expire after 10 minutes and can be used once. If a code hasn't arrived or has expired, use Resend code on the verification screen to get a fresh one.

Two ways 2FA gets switched on

2FA is required for a login if either the company requires it for that kind of user or the individual user has turned it on for their own account. You can use either or both.

Company-wide requirement (admins)

Company admins control this under Settings → Security. There are two independent toggles:

Require email two-factor authentication for team logins — every team member (admins and users) must verify by email each time they sign in.
Require email two-factor authentication for client logins — every client user must verify by email each time they sign in.

Tick the boxes you want and choose Save Security Settings. The Settings page is admin-only, so only company admins can turn these company-wide requirements on or off.

When a company-wide requirement is on, it applies to everyone of that type — individuals cannot opt out of it.

Per-user opt-in

Even when the company-wide requirement is off, 2FA can be enabled for a single account:

Team members: an admin edits the person under Team Members and ticks Enable email two-factor authentication on their edit form.
Client users: each client user can turn it on for themselves from their own Profile by ticking Enable email two-factor authentication.

Turning 2FA off

Un-tick the relevant box and save. Company-wide requirements are cleared from Settings → Security; a per-user opt-in is cleared from the same place it was set (the team member's edit form, or the client user's profile). Remember that if a company-wide requirement is still on, clearing an individual opt-in has no effect — that user is still required to verify.

Troubleshooting

Symptom	What to do
Code email never arrives	Check the spam folder, then use Resend code. Verification codes are sent through your normal email delivery — if no FrameCourier email is arriving at all, see Emails not arriving.
“Invalid or expired code”	Codes last 10 minutes and work once. Request a fresh one with Resend code, or start the sign-in again.
A client can't receive codes	Confirm the client user's email address is correct under Client users & invites, then have them resend.