Two-step verification

Two-step verification lives under Settings → Security. In the left sidebar, click Settings (at the bottom). In the settings menu, under General, click Security. It asks for a 6-digit code from an authenticator app in addition to your usual sign-in.

Two-step verification is per person. You turn it on for your own account. Owners and admins cannot turn it on for someone else, but they can reset it if a team member is locked out.

How do I turn on two-step verification?

In Settings → Security, add an authenticator app to your own account. The Two-step verification section shows Not enabled until setup is complete.

Use Settings (1) in the left sidebar and Security (2) in the settings menu to get to this page.

Use Status (1) to see whether two-step verification is Not enabled or Enabled, and Set up (2) to start adding an authenticator app.

1. In the left sidebar, click Settings (at the bottom). In the settings menu, under General, click Security.
2. In Two-step verification, select Set up.
3. If Ona asks you to confirm it is you, enter your password, or select Confirm with Google or Confirm with Apple.
4. Scan the QR code with an authenticator app such as Google Authenticator, 1Password or Authy. If you cannot scan it, select Can't scan the code? and enter the setup key in your app instead.
5. Select I've scanned it.
6. Enter the 6-digit code from the app, then use Name this authenticator to give it a recognizable name.
7. Select Turn on two-step verification.

The section changes to Enabled, and Ona asks for a code from that app the next time you sign in.

How do I set up a backup authenticator?

In the left sidebar, click Settings (at the bottom). In the settings menu, under General, click Security. Set up your backup while the QR code is still on screen in Settings → Security. Scan the same QR code into a second app or device, such as your phone and your password manager.

There is no separate action to add another authenticator later. The practical way to keep a backup is to scan the same setup code into more than one place during setup. Both apps generate the same 6-digit codes.

If you already finished setup without a backup, remove the authenticator and set up two-step verification again. Scan the new QR code into both places before selecting I've scanned it.

Why does two-step verification say Unavailable?

In the left sidebar, click Settings (at the bottom). In the settings menu, under General, click Security. In Settings → Security, Unavailable means your email address has not been verified yet. Ona can only turn on two-step verification after your email address is confirmed.

Use Current status (1) to see that two-step verification is Unavailable, and Set up two-step verification (2) is the control you use after your email is confirmed.

1. In the warning alert, select Send verification email.
2. Open the verification email and confirm your address.
3. Return to Security and set up two-step verification.

After your email is confirmed, the section is ready for setup.

What happens when I sign in after turning it on?

After two-step verification is enabled in Settings → Security (in the left sidebar, click Settings at the bottom, then under General, click Security), sign in with your usual method first. Then enter the 6-digit code from your authenticator app.

Authenticator apps generate a fresh code every 30 seconds. If a code is rejected, wait for the next code and try again.

How do I turn off two-step verification?

In the left sidebar, click Settings (at the bottom). In the settings menu, under General, click Security. Use Settings → Security to remove your authenticator. Removing your only authenticator turns two-step verification off for your account.

1. In Two-step verification, select Remove next to the authenticator.
2. Review the confirmation message.
3. Select Remove.
4. If Ona asks you to confirm it is you, enter your password, or select Confirm with Google or Confirm with Apple.

After removal, you sign in with your usual sign-in method again. Removing an authenticator can sign you out; if that happens, sign back in.

How does an owner or admin reset two-step verification for a team member?

Owners and admins can reset a locked-out team member from Settings → Team Members. In the left sidebar, click Settings (at the bottom). In the settings menu, under General, click Team Members. Then select the team member, open Personal info, and use the Two-step verification section to reset it. Resetting clears the member's existing authenticator so they can set up a new one.

Use Settings (1) in the left sidebar and Team Members (2) in the settings menu to get to the members page.

Use Personal info (1) to open the member profile, Two-step verification (2) to reach the reset area, and Manage in your settings (3) when this is your own account.

1. Select the team member.
2. Open Personal info.
3. In Two-step verification, select Reset.
4. Follow the confirmation prompt.

The team member's old authenticator is cleared. They can set up two-step verification again from Security after they sign in.

What can't I do here?

In the left sidebar, click Settings (at the bottom). In the settings menu, under General, click Security. Access and actions are limited in these ways:

• You cannot turn on two-step verification for another team member. Each person sets it up for their own account.
• Staff and clinicians cannot reset another team member's two-step verification. Only owners and admins can do that.
• You cannot add a second authenticator later from Settings → Security. Scan the setup code into a backup app during setup instead.
• You cannot turn on two-step verification until your email address is confirmed.
• If you are locked out of your own account, ask an owner or admin to reset two-step verification for you.

Common questions

Do I need an authenticator app?

Yes. Two-step verification uses 6-digit codes from an authenticator app.

Which authenticator apps work?

Apps such as Google Authenticator, 1Password and Authy work. You can use any authenticator app that supports 6-digit codes.

Can an owner or admin require everyone to use two-step verification?

This article covers the personal two-step verification setting. Each team member turns it on for their own account in Settings → Security: in the left sidebar, click Settings (at the bottom), then under General, click Security.

What should I do if I lose my phone?

Use your backup authenticator if you scanned the QR code into one during setup. If you do not have a backup, ask an owner or admin to reset two-step verification for your account.

Where can I learn about team member access?

See Inviting your team & roles and Roles, licences, and permissions.