# How to let your clients use two-factor authentication

Turn the Allow two-factor authentication switch on or off in Settings to offer an authenticator app to your clients.

Two-factor authentication adds a second sign-in step: a 6-digit code from an authenticator app. On the Agency plan, the Allow two-factor authentication switch decides whether your clients can turn that app on for their own accounts. The switch only offers the app, and a client sets it up only by turning it on.

The switch applies to your organization's own domain, the one you connect under Domains on the Settings page. On that domain, the only method offered is an authenticator app. On tarkle.com the switch has no effect. For how clients reach the platform you set up, see [How do clients get access to their workspace?](https://tarkle.com/help/agency-plan/how-clients-get-access).

## Steps

1. **Open Settings.** Open [Settings](/dashboard/settings) of your organization.
2. **Find Platform settings.** Look for the card titled **Platform settings**.
3. **Check Allow two-factor authentication.** The switch shows as on until you turn it off. Turn it on to offer an authenticator app to your clients, or off to stop offering it.

The switch saves as soon as you change it. If the change cannot be saved, the switch goes back to its previous position and an error message appears.

## What your clients see

On your organization's domain, a client opens **Personal account** and finds the **Multi-factor authentication** card. Its **Authenticator app** row has a switch. Turning it on opens a dialog titled **Set up authenticator app**, with a QR code and the line "Or enter this key:". The client scans the code or enters the key in an authenticator app, then types the 6-digit code it shows and selects **Turn on**. Cancel closes the dialog and removes the unfinished setup.

A wrong code shows "That code did not work. Try the next one." A correct code shows "Authenticator app turned on." Once it is on, Tarkle asks for the 6-digit code when the client signs in. To turn it off, the client flips the same switch. It turns off at once, with no confirmation, and the client sees "Authenticator app turned off."

## Which plans show the switch

The **Allow two-factor authentication** row appears only for an organization on the Agency plan. Free and Pro organizations do not see it. Reseller accounts on Reseller Pro get the same switch in their reseller settings, and reseller accounts below Reseller Pro see it locked with a Reseller Pro badge. To compare plans and prices, see [Tarkle pricing](/pricing).

## What turning the switch off does

Turning the switch off hides the Multi-factor authentication card on your organization's domain, so clients cannot turn the authenticator app on or off there while the switch is off. It does not turn off the app for clients who already turned it on. Those clients are still asked for the 6-digit code when they sign in. Turn the switch back on to show the card again.

## What happens next

Clients who want the extra protection turn on the authenticator app under **Personal account** on your domain. For the sign-in methods of a personal account, see [How to turn on two-step sign-in or a passkey](https://tarkle.com/help/account/how-to-turn-on-two-step-sign-in-or-a-passkey).

## Related articles

- [How do I set up white label on the Agency plan?](https://tarkle.com/help/agency-plan/set-up-white-label)
- [Agency plan price and billing](https://tarkle.com/help/agency-plan/agency-plan-price-and-billing)

Source: https://tarkle.com/help/agencies-and-resellers/let-clients-use-two-factor-authentication