Two-step authentication (also called Strong Customer Authentication, or SCA) adds a second verification step to confirm your identity for sensitive actions — such as logging in, revealing a card PIN, or approving a wire transfer. This article explains how to set up and manage your authentication method.
For: All Spendesk users.
Before you start
No specific role is required. Every Spendesk user must set up at least one two-step authentication method.
Spendesk supports three methods: Authenticator app (TOTP), Spendesk mobile app, and Text message (SMS).
We recommend setting up more than one method so you always have a backup if one becomes unavailable.
To use SMS, you must first add your mobile phone number to your profile.
To enroll in TOTP directly from your phone (without a web browser), you need the Spendesk iOS app. Android in-app enrollment is coming soon.
Set up your two-step authentication (web)
Step 1 — Open your profile
Click your avatar in the bottom-left corner of Spendesk.
Select My Profile.
Step 2 — Add an authentication method
Click the Security tab.
Click Add an authentication method under Authentication methods.
Step 3 — Choose your method
Two methods are available from this screen: Authenticator app and Spendesk mobile app. You can also enable Text message (SMS) by adding your phone number in the Phone number section of your profile.
Option A — Authenticator app (TOTP)
The Authenticator app method uses the TOTP (Time-based One-Time Password) standard — a widely adopted security protocol that generates a new 6-digit code every 30 seconds. TOTP is available as of June 26, 2026.
Select Authenticator app.
Download a TOTP-compatible app on your mobile device or computer:
Microsoft Authenticator — mobile and desktop
1Password — mobile and desktop
Click Show the QR code in Spendesk.
Scan the QR code with your authenticator app.
Click Continue.
Enter the 6-digit code shown in your authenticator app to confirm setup.
At your next sensitive action (login, reveal PIN, wire transfer), select Use an alternate authentication method to use your authenticator app code.
💡 Tip: Store your authenticator app backup codes or link the app to a cloud account. This ensures you can restore access if you switch phones.
Option B — Authenticator app (TOTP) via Spendesk iOS app
You can now enroll in TOTP directly from the Spendesk iOS app, without using a web browser.
Open the Spendesk iOS app.
Follow the in-app prompts to set up TOTP authentication.
Confirm enrollment when prompted.
💡 Note: Android support for in-app TOTP enrollment is coming soon. Android users should set up TOTP through the web app for now.
Option C — Spendesk mobile app (push notification)
Select Spendesk mobile app.
Download the Spendesk mobile app on your phone.
Follow the in-app steps to register your phone as a trusted authentication device.
When a sensitive action requires authentication, you will receive a push notification. Open the app and approve the action directly.
⚠️ Note: Only one device can be registered for mobile app authentication at a time. If you change phones, you will need to re-enroll.
Option D — Text message (SMS)
Go to My Profile and add your mobile phone number in the Phone number section.
Select the SMS method when prompted for two-step authentication.
⚠️ Security note: SMS is the least secure method and is vulnerable to SIM swap and SS7 attacks. Use it only as a backup when other methods are not available.
Where two-step authentication is required
Once set up, your authentication method is used to confirm the following actions:
Action | Required |
Log in to the Spendesk web app | Yes |
Reveal a physical card PIN | Yes |
Reveal a virtual card PAN | Yes |
Show or reset payment password (UK only) | Yes |
Approve a wire transfer | Yes (Account Owners) |
Access transaction data on the web app | Yes (every 90 days — AOs, Controllers, Admins) |
👥 Roles: Only an Account Owner or Administrator can issue a recovery code to unblock a user who has lost access to their authentication method.
Security recommendations
Set up multiple methods so you can still access your account if one becomes unavailable.
Prefer TOTP or the Spendesk app over SMS — both are more secure and not vulnerable to SIM swap attacks.
Keep your authenticator app linked to a cloud account (Google, Microsoft) or back up your recovery codes so you can restore access if you change phones.
⚠️ Warning: If you lose access to all your authentication methods, you cannot log in or complete sensitive actions until an Account Owner or Administrator issues a recovery code.
Troubleshooting
I changed phones. Will my authenticator app still work?
Most authenticator apps sync to the cloud via your account (Google, Microsoft). Install the app on your new device, sign in with the same account, and your codes will be restored automatically. If you used an app without cloud sync, you may need to re-enroll in Spendesk using a new QR code after your Account Owner issues a recovery code.
I lost access to my authenticator app and cannot log in or complete a sensitive action.
Contact your Account Owner or Administrator to request a recovery code.
On the Choose a way to authenticate screen, click Lost access to your authentication method?
Enter the recovery code to restore access.
Once logged in, set up a new authentication method immediately.
I am not receiving push notifications from the Spendesk app.
Check that notifications are enabled for the Spendesk app in your phone's settings.
Open the app manually — if a pending action exists, the confirmation screen will appear automatically.
Make sure the app is updated to the latest version.
If the issue persists, delete and reinstall the app.
Frequently asked questions
Can I use multiple authentication methods at the same time?
Yes. Spendesk supports having more than one method configured. We recommend it as a backup strategy.
Can I switch back to SMS if I set up TOTP?
Yes. You can add or remove authentication methods at any time from My Profile > Security.
Why can't I use SMS anymore after setting up the mobile app?
Once you enroll the Spendesk mobile app as your primary method, it becomes your default. You can still add SMS as a backup from your profile settings.
Is TOTP available for all users?
Yes. TOTP (Authenticator app) has been generally available since June 26, 2026, for all Spendesk users.
Related articles
Legal framework: secure your access to Spendesk
Strong customer authentication (SCA) on mobile
Reset or change your Spendesk security code
3DS common issues
How can an Account Owner or Administrator unblock a user who has lost access to their authentication methods?