> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ndumed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up and use two-step verification

> Turn on two-step verification in NduMed with an authenticator app, sign in with a code or a recovery code, generate new recovery codes and turn it off.

Two-step verification protects your NduMed account with a 6-digit code from an authenticator app on your phone, in addition to your password. It is **required** for Doctors, Nurses, Lab technicians, Pharmacists and Cashiers, and optional for Administrators, Receptionists and Auditors.

## Set it up

If your role requires it, NduMed takes you to the setup page the first time you sign in. Otherwise, open `/account/mfa` on your hospital's NduMed address and select **Set up two-step verification**.

**1. Scan the QR code**

Open your authenticator app (for example Google Authenticator, Microsoft Authenticator or 1Password) and scan the QR code. If you cannot scan it, use the key shown under "Can't scan? Enter this key manually". The account appears as **NduMed** in the app.

**2. Enter the code**

Type the 6-digit code your app shows and select **Turn on two-step verification**. Finish within 10 minutes of opening the page.

**3. Save your recovery codes**

NduMed shows **10 recovery codes**. You will not see them again. Print them or store them in a password manager, then select **Continue**.

## Sign in with a code

After your password, the **Two-step verification** page asks for the 6-digit code from your app. Enter it and select **Verify**. Each code works once and changes every 30 seconds.

> [!TIP]
>
> If codes are always rejected, check that your phone's clock is set automatically. A phone clock that is a minute or more out causes wrong codes.

## Use a recovery code

If you do not have your phone, select **Use a recovery code instead** and enter one of your saved recovery codes. Each recovery code works once.

## Manage two-step verification

Open `/account/mfa` to see whether two-step verification is on and how many recovery codes remain. From there you can:

* **Generate new recovery codes**: replaces all your old codes. Do this when you are running low.
* **Turn off two-step verification**: only if your role does not require it. Required roles see "Your role requires two-step verification, so it cannot be turned off."

## Lost phone and no recovery codes

> [!WARNING]
>
> If you lose both your phone and your recovery codes, you cannot sign in, and resetting your password does not remove two-step verification. NduMed does not currently provide an administrator reset for two-step verification. Contact NduMed support through your hospital administrator. See [Contact support](https://docs.ndumed.co/help/contact-support.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.