Two-Factor Authentication
Two-factor authentication (2FA) requires a password and a one-time code before someone can access your Chargebee site. It protects payment and sales information if a password is compromised.
Setting up two-factor authentication on Chargebee
Two-factor authentication keeps your account from being opened with only a password. Log in to Chargebee and follow these steps.
-
Log in to your Chargebee user interface. On the bottom left corner, click Profile name > Manage Account/Edit profile > Two-factor authentication.
-
Click Enable.
-
You are presented with a QR code to be scanned using the authenticator app on your mobile device.
-
Enter the 6-digit code that appears in your authenticator app and click Submit. This connects your authenticator app with Chargebee.
-
After 2FA is set up, use the 6-digit code from your authenticator app the next time you log in to Chargebee.
-
You need to disable Single Sign-On to enable two-factor authentication. To disable SSO, click Profile name > Manage Account/Edit profile > Go to Security. Under Authentication > SSO > click Disable > Confirm.
You can disable the 2FA feature at any time by clicking the Disable option in the 2FA section on your Profile page. Once disabled, your account will be secured by your password alone. If you would like to enable 2FA once again, follow steps 1-5 again.
Recovery Codes
If you cannot open your authenticator app, enter one of your recovery codes to access your account.
To download your recovery codes, open your profile from the navigation bar and click Username > Edit Profile. To generate new codes, select Generate New Codes on that page and download the updated set.
-
Each recovery code is valid once. You cannot use the same recovery code twice.
-
Recovery codes are available only when two-factor authentication (2FA) is enabled.
-
Recovery codes are available for download as a .TXT file.
Remember device for 30 days
2FA includes a Remember me on this device for 30 days option. After you set up two-factor authentication, turn this on to skip the authenticator app on that device for 30 days.
Reset two-factor authentication
This feature allows site admins to reset Two-Factor Authentication (2FA) for team members under specific conditions, preventing unauthorized 2FA resets.
A 2FA reset is allowed only if the admin and the user are associated with the same company. This means all sites associated with the admin and user must share the same Chargebee's customer identifier.
Step 1: Request for resetting two-factor authentication
When a user logs in, a message is displayed indicating if the user is eligible for a 2FA reset by their site admins. This message provides clear guidance on the available options. Learn more.
Step 2: Reset two-factor authentication for a user
Only the Admin can perform the Reset action for a user by following these steps:
-
Log in to the Chargebee site.
-
Navigate to the Settings > Team Members page. The admin can view users whose 2FA can be reset.
-
Click the Reset 2FA option to reset the user's 2FA.
Step 3: Notify user about the two-factor authentication reset via email
After the admin resets a user's 2FA, the user receives an email about the reset. The user logs in to their Chargebee site and sets up 2FA again.
Enforce User Authentication Policy
To set an authentication policy for everyone on your site, see Add Users & Assign Roles.
FAQ
1. What happens if I lose my phone or don't have access to my mobile authenticator app?
If you lose your phone or cannot open your authenticator app, use a recovery code to log in. Download the codes after you finish setting up 2FA. See Recovery codes.
2. What happens if I don't have access to my mobile authenticator app or my recovery codes?
Your site admin can reset your 2FA by following these steps.
Why am I prompted to contact Chargebee Support for a 2FA reset?
When the Chargebee sites you belong to are associated with multiple companies (Chargebee's customer identifier), you may be prompted to contact Chargebee Support for a 2FA reset.
Example 1: Alice is part of three Chargebee sites:
- acme (belongs to company Acme)
- acme-test (belongs to company Acme)
- securepay-test (belongs to company SecurePay)
Since Alice is associated with sites from two different companies (Acme and SecurePay), her 2FA cannot be reset by an admin.
Example 2: Bob is part of three Chargebee sites:
- acme (belongs to company Acme)
- acme-test (belongs to company Acme)
- acme-migration (belongs to company Acme)
Since all three sites belong to the same company (Acme), any admin of these sites can reset Bob's 2FA, provided the admin is also associated only with Acme's sites.
This restriction ensures security by preventing unauthorized 2FA resets across multiple companies.