Skip to main content
Understanding permissions and security

Two-step verification and recovery codes

Authenticator codes, recovery codes and what to do if you lose both.

Last reviewed 25 October 2026

Everyone signs in with a password and a 6-digit code from an authenticator app.

Where it is asked for

Onzli also asks for a fresh code before sensitive actions, such as connecting accounting software, choosing a company, confirming VAT accounts, recording decisions, inviting people, changing roles, changing your password, and cancelling a plan.

Manage it

Open Account:

  • Change password. A three-step flow: your current password, a new one of at least 12 characters, then an authenticator code.
  • Recovery codes. You have ten single-use codes. Choose Regenerate, enter an authenticator code, and a new set is shown once. Regenerating invalidates the old codes.

If you lose your authenticator

Sign in with a recovery code: choose Use a recovery code instead on the code step. Each code works once.

If you lose both

There is no self-service reset. An administrator of the service must run the server-side credentials recovery. Contact the person who administers Onzli for your business.

Create an account and sign in

How a new person gets in, sets a password and activates two-step verification.

Roles and permissions

What each role can do, and who can submit to HMRC.