Setting up two-factor authentication (2FA)

Why two-factor authentication matters for your coaching account

Your Coachful account holds client data, payment details, session recordings, and private messages. A strong password alone is no longer enough — credential leaks happen to everyone, and a compromised coaching account can erode client trust overnight. Two-factor authentication (2FA) adds a second verification step so that even if someone steals your password, they still can't get in without physical access to your device.

Setting up 2FA on your Coachful account takes under three minutes. Once enabled, you'll be prompted for a time-sensitive code every time you sign in from an unrecognized device. Coaches on the Scale plan and any user with an admin or super_admin role are especially encouraged to enable it — you're managing sensitive org-wide data and billing.

TL;DR — Quick answer

• Go to Account → Security → Two-Factor Authentication and click Enable 2FA.
• Scan the QR code with an authenticator app (Google Authenticator, Authy, or 1Password).
• Enter the 6-digit code to confirm, then save your backup codes somewhere safe.
• On every new sign-in you'll enter your password and a fresh one-time code.

What you'll need before you start

Two-factor authentication on Coachful uses the TOTP standard (Time-based One-Time Password), which is supported by virtually every modern authenticator app. Before you begin, install one of the following on your phone:

• Google Authenticator — free, minimal, iOS & Android. Download guide from Google.
• Authy — free, supports encrypted cloud backup so you don't lose codes if you lose your phone.
• 1Password / Bitwarden — if you already use a password manager, these have built-in TOTP support and keep everything in one place.

You only need one app. Pick the one you already use, or Authy if you're starting fresh — its backup feature saves a lot of headaches if you ever switch phones.

How to enable 2FA on your Coachful account — step by step

1. Sign in to your Coachful workspace at app.coachful.co/sign-in.
2. Click your profile avatar in the top-right corner, then select Account Settings.
3. Open the Security tab. You'll see the Two-Factor Authentication section with a status badge showing Disabled.
4. Click Enable Two-Factor Authentication. A modal will appear with a QR code and a fallback text key.
5. Open your authenticator app, tap the + or Add account button, and choose Scan QR code.
6. Point your phone's camera at the QR code on screen. The app will immediately start generating 6-digit codes that rotate every 30 seconds.
7. Type the current code into the Verification code field on Coachful and click Confirm.
8. Coachful will display your backup codes — a set of one-time-use codes you can use if you lose access to your phone. Copy them and store them somewhere secure (a password manager or printed and locked away). Click I've saved my backup codes to finish.

That's it. 2FA is now active. The next time you sign in from a new browser or device, Coachful will ask for your password and then prompt you to enter the current code from your authenticator app.

Signing in with 2FA enabled

The sign-in flow with 2FA is straightforward:

1. Enter your email and password as usual on the sign-in page.
2. When prompted, open your authenticator app and enter the 6-digit code shown for your Coachful account. You have 30 seconds before it rotates — if it's about to expire, just wait for the next one.
3. Check Remember this device for 30 days if you're on a personal computer you trust. This skips the 2FA prompt for a month on that specific device.
4. Click Verify. You're in.

Coachful uses device fingerprinting to track trusted devices. Clearing browser cookies or using a private/incognito window will trigger a fresh 2FA prompt even on a remembered device.

Using a backup code when you've lost your phone

If you can't access your authenticator app — your phone is lost, stolen, or wiped — you can use one of the backup codes you saved during setup.

1. On the 2FA prompt screen, click Use a backup code instead.
2. Enter any unused backup code exactly as shown (no spaces).
3. Sign in, then immediately go to Account → Security and either regenerate your backup codes or reconfigure 2FA with your new phone.

Each backup code works only once. Once you've used all 10 codes and still can't access your authenticator app, contact Coachful support at help.coachful.co so an admin can verify your identity and reset your 2FA.

Managing 2FA as a coach admin — team-wide security

If you're an admin or super_admin on a Coachful org, you can see which team members have 2FA enabled and encourage or require adoption.

Navigate to Admin → Team → Members. Each user row displays a 2FA badge — green for enabled, grey for disabled. You can filter by 2FA status to identify accounts that need attention. At this time, Coachful does not enforce 2FA org-wide automatically, but this is a planned feature on the roadmap. In the meantime, any team member with a coach, editor, or higher role should be strongly encouraged to enable it.

Virtual assistants (VA accounts) with access to sensitive client records are especially worth auditing. A compromised VA account has the same level of access as the role assigned to it — if that's editor, it can publish content and interact with clients on your behalf.

Pro tip for coaches: Include a note in your VA onboarding checklist requiring 2FA setup before granting dashboard access. This single step dramatically reduces unauthorized-access risk with no technical overhead on your end.

2FA on the Coachful mobile app

Coachful's native iOS and Android apps (available via the mobile gateway) respect the same 2FA settings as the web dashboard. When you first sign in on a new mobile device, you'll see the same verification prompt. The authenticator app you've already set up works identically — just switch to it, copy the code, and switch back.

If you use the Remember this device option on mobile, Coachful stores a secure token tied to that device's install. Uninstalling and reinstalling the app, or signing out manually, will clear the token and require another 2FA check on next login.

Managing clients across programs, squads, bookings, and billing all from one place is already faster with Coachful — and 2FA means that unified workspace stays locked down. If you're not on Coachful yet, start your free trial and set up 2FA from day one.

Pro tips for keeping your account secure beyond 2FA

Two-factor authentication is the single highest-impact security step you can take, but it works best as part of a broader habit:

• Use a unique, strong password. A password manager (1Password, Bitwarden) generates and stores these for you. Never reuse a password from another service.
• Review active sessions regularly. Under Account → Security → Active Sessions, you can see every device currently signed into your account. Revoke any sessions you don't recognize.
• Keep your backup codes current. If you regenerate them, delete the old ones. Store the new set in your password manager, not in an email draft.
• Don't screenshot QR codes. If your photo library is compromised, so is your 2FA secret. Scan and discard — your authenticator app stores the secret securely.
• Enable Authy's app-level PIN. This prevents someone who picks up your unlocked phone from reading your TOTP codes.

Disabling or reconfiguring two-factor authentication

You might need to disable 2FA temporarily (e.g., switching authenticator apps) or reconfigure it after getting a new phone.

Switching phones or authenticator apps

1. Sign in to Coachful and go to Account → Security → Two-Factor Authentication.
2. Click Reconfigure 2FA. You'll be prompted to enter your current TOTP code to prove you still have access.
3. A new QR code is generated. Scan it with your new app or new device.
4. Enter the verification code and save new backup codes.

Turning off 2FA entirely

1. Go to Account → Security → Two-Factor Authentication.
2. Click Disable 2FA.
3. Enter your current password and a TOTP code to confirm the action.

Disabling 2FA is immediate. We recommend only doing this as a transitional step (e.g., you're switching apps) and re-enabling within minutes.

Troubleshooting common 2FA problems

The code is rejected even though it looks correct

TOTP codes are time-sensitive and depend on your phone's clock. If your phone's time is off by more than 30 seconds, codes will be invalid. Go to your phone's Date & Time settings and enable Set automatically. Then try a fresh code. This fixes the problem in nearly every case.

I lost my phone and have no backup codes

Contact Coachful support through help.coachful.co. You'll need to verify your identity using the email address on your account and answer security questions about your account activity. For coaches with active clients and billing, the verification process is thorough but usually resolved within one business day.

The QR code won't scan

If your phone's camera struggles with the on-screen QR code, use the manual entry (text key) option displayed below the QR code. In your authenticator app, choose Enter key manually and paste or type the key exactly as shown — it's case-insensitive.

I'm not being prompted for a 2FA code on sign-in

This usually means the device is still in the 30-day trusted window. You can force a fresh prompt by signing out, clearing your browser cookies, and signing back in. Alternatively, go to Account → Security → Active Sessions and revoke the current session, which will require a full re-authentication including the 2FA step.

My authenticator app shows "Coachful" twice

This can happen if you scanned a QR code more than once (e.g., during a failed setup attempt). Only the most recently added entry is valid — it's the one that was confirmed during your last successful 2FA setup. Delete the duplicate entry from your authenticator app to avoid confusion.

I'm a client, not a coach — do I have 2FA?

Yes. Client accounts on Coachful support 2FA with the same flow. Sign in to your client portal, go to Account → Security, and follow the same steps above. If you access your coach's platform through a custom domain (e.g., yourcoach.coachful.co), the security settings are still tied to your Coachful account and accessible from your profile menu.

Ready to lock down your Coachful account?

Enabling two-factor authentication is the fastest, most effective security upgrade you can make today. It protects your client relationships, your revenue, and the trust you've built — all for three minutes of setup time. Coaches who run their entire business through Coachful — programs, bookings, billing, community squads — have the most to gain from keeping that single account airtight.

Already a Coachful user? Sign in to your workspace and head to Account → Security to enable 2FA right now. Not on Coachful yet? Start your free trial and build your coaching business on a platform that takes security as seriously as you take your clients.