Recovery codes for people locked out

The way back in when the phone is gone. They have to be generated in advance, because the moment you need them is the moment you cannot sign in.

The way back in when the phone is gone. They have to be generated in advance, because the moment you need them is the moment you cannot sign in.

How they work

1. Codes are shown once when somebody enrols in two-factor, and they also arrive in the notification email that enrolment sends.
2. They store them somewhere safe and separate.
3. Each code works once, to sign in without the authenticator.
4. While still signed in, they can download a fresh set: profile icon, View profile, the Security Settings tab, Manage under Two-Factor Authentication, then Download recovery codes.

Save them at enrolment

Not later. Somebody who has lost their phone cannot sign in to download a set, which is exactly the situation the codes exist for. Make saving them part of the enrolment instruction rather than a follow-up.

Note the wording: a team member cannot generate a recovery code for themselves at all. They receive them and can download them; producing a new one for somebody locked out is an admin action.

Not on the same device

Codes stored on the phone with the authenticator are useless when the phone is lost. A password manager on another device, or printed and kept securely, both work.

They are as good as the password plus the phone

Anybody holding a code can sign in. They deserve the same care as a password, which means not in a shared document and not in a chat message.

The admin route, when both are gone

People will lose the phone and the codes. A Zendesk admin or the account owner can produce a recovery code for them.

1. In Admin Center, go to People > Team > Team members.
2. Click the person's name and open the Account tab.
3. Click Show recovery code.
4. Share the code securely, and tell them to enter it in the Passcode field.

The step that is yours rather than the product's is verification: confirm who is asking, ideally by voice or in person. A code handed out on the strength of an email is a hole in the control you just spent effort putting in.

Write down the procedure

Who to contact, how they verify you, how long it takes. Three lines, kept where people can reach them without signing in to Zendesk.

See also

• Two-factor authentication for team members
• My agent cannot sign in: what to check
• Resetting a team member's password