You can generate a recovery code to help a user who is stuck at the two-factor verification step and can't sign in. This guide shows the full process, from the user's first report to signing back in.
For: Account Owners and Administrators.
Before you start
Role needed: only an Account Owner or Administrator can generate a recovery code.
This article applies only when a user can still log in to Spendesk but is blocked at the extra verification step (Strong Customer Authentication, or SCA). This happens, for example, when they lost their phone, changed phone number, changed devices, or deleted their authentication app.
This is different from a user who forgot their password or is fully locked out of their account. Those cases are not covered here.
Why this happens
Spendesk uses Strong Customer Authentication (SCA) to keep accounts secure. SCA is an extra verification step required when signing in or approving certain actions. It works through one of the following methods:
An authenticator app (such as Google Authenticator), which generates a temporary code.
SMS, where a one-time code is sent to the user's registered phone number.
The Spendesk mobile app, which sends a push notification to approve the action.
This article only applies to users who cannot complete the SCA verification step. It does not cover forgotten passwords or full account lockouts.
What the blocked user experiences
A user who has lost access to their authentication method will:
Reach the Spendesk login page and enter their credentials normally.
Get stuck at the verification step, where they're asked for a code or approval they can no longer generate or receive.
Need to contact their Account Owner or Administrator to request a recovery code.
The user should contact their Account Owner or Administrator through a trusted channel, such as a direct message or phone call. They should not rely solely on email, since their email account may also be at risk.
Generate a recovery code
Once a user has reached out for help, an Account Owner or Administrator can generate a recovery code on their behalf.
Navigate to Settings > Organisation.
Open the blocked user's profile.
Click Edit member's profile.
Navigate to the Security tab.
Click Generate a recovery code.
Click I confirm on the confirmation prompt, only if you're certain of the requester's identity.
7. Choose how to share the recovery code: Manual sharing or Email delivery.
8. Authenticate yourself when prompted.
The recovery code is then delivered, either sent by email automatically or displayed for you to share manually.
⚠️ Warning: Always verify the requester's identity before generating a recovery code. If you suspect phishing, treat the account as compromised and do not proceed.
Sharing method | How it works | When to use it |
Manual sharing | The code is displayed on screen for you to copy. | Use this if you have any doubt about the requester's identity. Share it via a channel different from the one they used to contact you (for example, a phone call rather than email). |
Email delivery | The code is sent automatically to the user's registered email address. | Use this only if you're fully confident in their identity and their email account isn't at risk. |
Sign back in with the recovery code
Once the user receives the recovery code, they can use it to bypass the verification step and sign back in to Spendesk:
Sign in to Spendesk.
Click Use an alternate authentication method.
Click Enter a recovery code.
Enter the recovery code to complete sign-in.
💡 Tip: Once back in, set up a new authentication method straight away, either a new authenticator app, SMS, or the Spendesk mobile app, to avoid losing access again.
Troubleshooting
Symptom: The Administrator or Account Owner can't find the "Generate a recovery code" option.
Cause: The logged-in user doesn't have the Administrator or Account Owner role.
Resolution: Ask a current Account Owner or Administrator to perform the steps, or request a role update from your Account Owner.
Symptom: The user still can't sign in after entering the recovery code.
Cause: The code was mistyped, already used, or no longer valid.
Resolution: Ask an Account Owner or Administrator to generate a new recovery code and share it with the user immediately.
Symptom: The user can't reach the Spendesk login page at all, or their password doesn't work.
Cause: This is a different issue (forgotten password or full account lockout), not a lost authentication method.
Resolution: This scenario isn't covered by this article. Contact Spendesk support for help with password recovery or account lockouts.