Overview: Multi-Factor Authentication (MFA) adds a second step to signing in, so if your password becomes compromised, it isn't enough to reach your account. Managers can set it up on their own profile from the Buddy Punch website using an authenticator app, a passkey, or both.
Important! Multi-Factor Authentication is available on every Buddy Punch account. It is no longer limited to accounts using Buddy Punch Payroll.
Whether MFA is optional or required is set account-wide by your Account Administrator, and Managers can't change that setting. If you're being asked to set it up and aren't sure why, or you need the requirement changed, please reach out to your Account Administrator.
Instructions:
Set Up an Authenticator App
1. Start by clicking your profile icon in the top right corner, then My Profile:
2. Scroll to the Multi-Factor Authentication section and click Set up authenticator app:
3. Scan the QR code with an authenticator app on your phone — Google Authenticator, Microsoft Authenticator, Authy, and 1Password all work. If you can't scan it, enter the key printed beneath the code manually instead. Then enter the 6-digit code your app generates and click Verify:
4. Your recovery codes appear next. This is the only time they are shown, so click Download as .txt and keep the file somewhere safe. Then click Done:
Note: Each recovery code works once, and can be entered in place of an authenticator code if you don't have your phone. If you use them up or lose the file, you can create a fresh set from My Profile --> Regenerate recovery codes.
5. Back on My Profile, the Multi-Factor Authentication section now reads Authenticator app — Configured. From here you can remove the authenticator or regenerate your recovery codes at any time:
Add a Passkey
A passkey lets you complete the Multi-Factor Authentication step with your device's fingerprint, face, screen lock, or a hardware security key rather than typing a code.
Note: A passkey is a second factor, not a replacement for your password. You still sign in with your username and password first, then approve with the passkey.
1. From My Profile, in the Multi-Factor Authentication section, click Add a passkey:
2. Give the passkey a name if you'd like, so you can recognize which device it belongs to later, then click Create passkey:
3. Approve the prompt that your device shows — Touch ID, Face ID, Windows Hello, your screen lock, or a security key:
4. Once approved, the passkey is listed in the Multi-Factor Authentication section of your profile, where you can remove it later if you stop using that device:
Note: A passkey belongs to the device and browser you created it on, plus any device your iCloud Keychain or Google Password Manager syncs it to. If you sign in from more than one computer, add a passkey on each one or keep an authenticator app set up as a backup.
FAQs
Q: Do I have to set up Multi-Factor Authentication?
A: That depends on the account-wide policy your Account Administrator has set. If it's set to Required you'll be asked to set it up the next time you log in and won't be able to skip it. If it's Optional you can choose. Accounts using Buddy Punch Payroll always require it.
Q: Will I be asked for a code every time I log in?
A: If you tick Remember this browser? on the verification screen, that browser won't ask again for 14 days.
Q: What happens if I lose the phone with my authenticator app?
A: Enter one of your recovery codes in place of the authenticator code. If you've used them all or never saved the file, ask your Account Administrator to reset Multi-Factor Authentication on your profile — that lets you set it up again the next time you log in.
Q: I don't have a smartphone. What are my options?
A: Authenticator apps are also available as desktop apps and browser extensions, and a passkey can use your computer's fingerprint reader, face recognition, or screen lock, or a hardware security key. If none of those work for you, please reach out to your Account Administrator.
Q: Can I use text message codes instead?
A: Text message codes still work for users who already had them set up, but they aren't offered for new setups. An authenticator app or a passkey is offered instead, as both are more resistant to phishing and SIM-swap attacks than SMS.
Q: Can I set up more than one method?
A: Yes. You can have an authenticator app and one or more passkeys on the same profile. When you log in, the verification screen lets you choose which one to use.
Q: Do I need to set this up in the Buddy Punch mobile app too?
A: No. Multi-Factor Authentication applies when signing in on the website. The mobile apps don't currently prompt for it.