Skip to main content

​
Overview

Voxworks protects your account with three separate, independent codes — they are not interchangeable and each serves a different purpose:
  • Multi-Factor Authentication (MFA) — an authenticator-app code you enrol yourself, checked every time you sign in.
  • Mobile number verification — a one-off SMS code that confirms the mobile number on your profile is really yours.
  • Email verification codes — 6-digit codes sent to your signed-in email address that gate destructive, irreversible actions like deleting an account.
This page covers all three. For the email codes used specifically when deleting a team or your personal account, see Deleting an Account or Team.

​
Setting Up Multi-Factor Authentication (TOTP)

Voxworks supports authenticator-app factors — also known as TOTP (Time-based One-Time Password) — using apps like Google Authenticator, Authy or 1Password. To enrol a factor:
  1. Click your profile picture in the sidebar and choose Personal Settings.
  2. Select the Multi-Factor tab in the left-hand menu.
  3. Click Setup a new Factor.
  4. Give the factor a memorable name (for example, “iPhone 14”) so you can identify it later, then continue.
  5. Scan the QR code with your authenticator app.
  6. Enter the 6-digit code your app generates — for example 482913 — and click Enable Factor.
Once enrolled, the factor appears in a table on the Multi-Factor tab with its Factor Name, Type and Status (verified factors show a Verified badge). Each row has a remove button — click it, then confirm in the Unenroll Factor dialog to remove the factor. Once removed, it can no longer be used to sign in. If you have no factors enrolled yet, the Multi-Factor tab shows a prompt to secure your account; nothing about your sign-in changes until you enrol at least one factor.

​
Signing In With Multi-Factor Authentication

Once you have at least one verified authenticator factor, Voxworks requires it on every sign-in — password sign-in, magic link or Google OAuth all lead to the same challenge if a factor is enrolled. After you complete your primary sign-in, the app checks whether your session has cleared multi-factor verification. If it hasn’t, you’re redirected to the verification page (/auth/verify):
  • If you have more than one enrolled factor, you’re first asked to choose which one to use (“Choose a factor to verify your identity”), shown as a list of your factor names.
  • If you have exactly one enrolled factor, it’s selected automatically and you go straight to the code entry step.
  • Enter the current 6-digit code from your authenticator app (for example 118204). An incorrect code shows an “Invalid Verification Code” message and lets you try again.
  • On success you’re redirected to the page you were originally headed to.
You cannot reach any page under your workspace until this challenge is cleared — Voxworks enforces it centrally, not just on the sign-in screen, so it also applies if your session is still mid-verification and you try to open a workspace link directly. If you lose access to your authenticator app, an existing factor can only be removed by someone who can already sign in and pass the challenge, or by Voxworks support — speak to the Voxworks team if you’re locked out.

​
Verifying Your Mobile Number (SMS)

Separately from sign-in, Voxworks verifies the mobile number on your profile the first time you set it — this is a one-off proof that the number is genuinely yours, not a recurring sign-in factor. This step runs during setup, right after you enter your personal details: Voxworks texts a 6-digit code to the number you entered and asks you to enter it before you continue. Key behaviour:
  • Australian mobile numbers only — accepted formats include 04XX XXX XXX, +61412345678 and 61412345678. Landline numbers and non-Australian numbers are rejected.
  • The code is a 6-digit numeric code, entered as six individual digit boxes; pasting a copied 6-digit code fills all the boxes at once.
  • Resend cooldown: after a code is sent, Resend verification code is disabled for 60 seconds.
  • Rate limit: no more than 3 codes per mobile number per rolling hour. If you exceed this, sending is blocked with a “Too many attempts. Please try again in an hour” message until the window resets.
  • If you didn’t receive the code, the screen offers a support contact link as a fallback.
Once verified, the number stays verified unless you later change it during setup — changing the number clears the verified status and starts the SMS check again for the new number. Updating your mobile number afterwards from Personal Settings does not trigger a new SMS check. A verified mobile number is used elsewhere in the product — for example, as the destination for “My Phone” test calls — see Your Profile & Personal Settings for where it’s used day to day. SMS-based multi-factor sign-in (receiving a code by text as an alternative to an authenticator app) is not yet available — authenticator-app (TOTP) factors are the only supported sign-in factor today.

​
Email Verification Codes for Sensitive Actions

Some destructive, irreversible actions are gated behind a one-off email code rather than (or in addition to) your regular sign-in:
  • Deleting your personal account
  • Deleting a team
  • Transferring a team’s primary ownership to another member
In each case, Voxworks sends a 6-digit code to the email address of the account you’re currently signed in with. You click Send Verification Code, enter the code, and the destructive action only becomes available once it’s confirmed. If a code doesn’t arrive or expires, Request New Code sends a fresh one. This protection is independent of the authenticator-app MFA described above — it applies even if you don’t have a factor enrolled, and an enrolled factor doesn’t skip it. For the full deletion flow, including what happens to your data, see Deleting an Account or Team. For ownership transfer, see Inviting & Managing Members.

​
Next Steps