Understanding permissions and security
Two-step verification and recovery codes
Authenticator codes, recovery codes and what to do if you lose both.
Last reviewed 25 October 2026Everyone signs in with a password and a 6-digit code from an authenticator app.
Where it is asked for
Onzli also asks for a fresh code before sensitive actions, such as connecting accounting software, choosing a company, confirming VAT accounts, recording decisions, inviting people, changing roles, changing your password, and cancelling a plan.
Manage it
Open Account:
- Change password. A three-step flow: your current password, a new one of at least 12 characters, then an authenticator code.
- Recovery codes. You have ten single-use codes. Choose Regenerate, enter an authenticator code, and a new set is shown once. Regenerating invalidates the old codes.
If you lose your authenticator
Sign in with a recovery code: choose Use a recovery code instead on the code step. Each code works once.
If you lose both
There is no self-service reset. An administrator of the service must run the server-side credentials recovery. Contact the person who administers Onzli for your business.
Related articles
How a new person gets in, sets a password and activates two-step verification.
What each role can do, and who can submit to HMRC.