Two-factor authentication and sessions

Result

Your master key needs two locks, your backup codes live off your phone, your agency closes forgotten sessions and HighLevel's support badge is under your control.

Estimated time

35 minutes

Cost

US$ 0. This lesson uses no wallet balance.

Analogy

Step-by-step guide

Menu paths are shown as they appear in the English interface. If your team works with the account in Spanish, the Spanish names are in parentheses; HighLevel leaves some labels in English.

1. 01

   Check your second lock

   Settings → My Profile → SecurityCopy path

   In a Spanish-language account: Configuración → Mi perfil → Seguridad

   From Agency View, open Settings → My Profile → Security. It's the tab from mission 1.

   Find the Two-factor Authentication (2FA) App section. If you still see the Setup Two-factor Authentication (2FA) App button, your app isn't set up: do it today, as in mission 1.

   If it's already on, the section shows it. That's the screen for screenshot 1.

   Open your authenticator app and confirm it has a HighLevel entry. It may show your agency name.

   If anyone else has a login on your account, ask them today whether they've turned theirs on, and write it down. Each person turns it on in their own profile, inside a sub-account too.

   Key points

   • Two-factor authentication belongs to each user. Only the signed-in person can set up their app; an admin can't do it for someone else, not even by entering as them with Login As.
   • HighLevel doesn't document a switch to require it for your whole team, and your agency's Advanced Settings has none. Users keep asking for one on HighLevel's idea board, where it's still marked "Planned" today.
   • So your policy is a rule plus a check: you ask everyone to turn it on, and you check that they did.
   • This isn't just AXIS advice. HighLevel's Terms (June 2026) make you responsible for enabling two-factor authentication on your account and on all your users' accounts. If a breach comes from skipping it, HighLevel isn't liable.
   • Why an app: CISA treats text-message codes as a last resort, and NIST restricts SMS and doesn't accept email as a second factor.
   • Even so, no six-digit code stops a phishing scam on its own. Two-factor lowers the risk; it doesn't erase it.
   • In a Spanish-language account, the path is «Configuración → Mi perfil → Seguridad» and the section is «Aplicación de autenticación de dos factores (2FA)».

   Source: F1, F2, F3, F14, F15

2. 02

   Get your backup codes off your phone

   Settings → My Profile → SecurityCopy path

   In a Spanish-language account: Configuración → Mi perfil → Seguridad

   Find where the 10 backup codes from mission 1 ended up.

   If they're in a photo, a note or a chat on the same phone as the app, move them today. HighLevel asks for a secure place separate from your password: printed and locked away, or in a password manager other than the one holding your HighLevel password.

   If you've used one, lost them or someone saw them, generate a new set on this same Security tab.

   Also check whether you saved a screenshot of the setup QR code from day one, in your photos or your email. If it exists, delete it. If it sat in an email, a chat or a cloud folder, treat the key as seen: set up the app again under Security so the key changes.

   Before you switch phones, move your codes with your app's own feature. Google Authenticator syncs them to your Google Account or exports them; Microsoft Authenticator backs them up to the cloud for a phone on the same system.

   For your evidence, write down only the place: "printed and locked away" or "a password manager separate from my password". Never write the codes.

   Key points

   • If you lose your phone, a backup code is the only way back in that HighLevel documents. Each code works once.
   • If you lose your phone and your codes too, HighLevel doesn't document what happens. That's exactly the day you don't want to find out.
   • The setup QR code is your key as a picture. Anyone who sees a photo of it can generate your codes, so it never goes in a screenshot or a chat.
   • If you lose your phone, first make sure nobody can use the codes on it: lock or erase it remotely. Then sign in with a backup code. If you couldn't erase it or your app had no backup, set up the app again under Security; if you erased it, restore your codes from your app's backup.
   • If you also change numbers, HighLevel asks for a code through a channel that's already verified before it updates yours. It never sends that code to the new number.

   Source: F1, F4, F16, F17, F18, F13

   1Lock or erase the phone remotely

   2Are your backup codes somewhere other than the phone?

   Yes

   Sign in with a backup codeIf you erased the phone, restore the app from its backup; if not, set it up again under Security

   Generate new codes and use Sign Out Everywhere

   No

   Contact HighLevel’s official supportHighLevel doesn’t document this case; AXIS Tutor drafts the message

   Before you switch phones

   Move the codes with your app’s backup or exportNever photograph the QR code

   Settings → My Profile → Security

3. 03

   Know where the emergency exit is

   Settings → My Profile → SecurityCopy path

   In a Spanish-language account: Configuración → Mi perfil → Seguridad

   On the same Security tab, find Sign Out Everywhere. It ends your sessions on every device, including the one you're using.

   Use it if you lose your laptop or phone, if you signed in on a computer you don't control, or if someone may have seen your password.

   If you suspect your password, the order is this: first change it in the Password section with Update password; then click Sign Out Everywhere.

   You don't need to click it today. Just find it, so you aren't hunting for it the day you need it.

   Key points

   • According to HighLevel's help center, changing your password on the web "may" end your other sessions; in the mobile app, it ends all of them. So after the change, use Sign Out Everywhere.
   • For the password, HighLevel requires at least 12 characters, with uppercase and lowercase letters, numbers and a symbol, and rejects any that falls short. It also asks you not to use it anywhere else. NIST asks for 15 when a password stands alone. A passphrase of 15 or more characters with those elements, kept in your password manager, meets both.
   • With Login As, an agency admin enters a sub-account as one of its users, without their password, and whatever they do is logged under that user's name. Your master key opens every other one: protect it first.
   • An agency admin can also sign a user out of every session: enter as them with Login As and use Sign Out Everywhere. You'll use this in lesson 3, when someone leaves your team.
   • Your login is yours alone. HighLevel's Terms make you responsible for everything done with your access, whether you authorized it or not.
   • Anyone who works with you gets their own login. In lesson 2 you give it only the permissions it needs.
   • In a Spanish-language account you'll see «Cerrar sesión en todas partes» and, under «Contraseña», the «Actualizar la contraseña» button.

   Source: F5, F4, F6, F12, F14, F3

4. 04

   Make the door close on its own

   Settings → Company → Advanced SettingsCopy path

   In a Spanish-language account: Configuración → Empresa → Advanced Settings

   From Agency View, open Settings → Company and go to the Advanced Settings tab.

   Find Session Timeout. If someone stays idle for the time you choose, HighLevel ends their session and they have to sign in again.

   The options are 15 min, 1 hrs, 4 hrs, 8 hrs, 12 hrs, 1 day, 2 days, 3 days and Never. It ships set to Never.

   AXIS recommends 1 hrs as a general rule. If your business has a computer several people share, like the one at the front desk, choose 15 min.

   Save the change, and note in your log the value you chose and why.

   Key points

   • HighLevel recommends 30 to 60 minutes for most agencies, but its list jumps from 15 minutes to 1 hour. One hour is also NIST's inactivity ceiling.
   • OWASP suggests 15 to 30 minutes for low-risk applications, and HighLevel calls this setting especially useful on shared devices. That's why a shared computer gets the shortest value.
   • It's a single setting for your whole agency. HighLevel says Advanced Settings affects the agency and its sub-accounts, but it doesn't say so about Session Timeout by name or mention the mobile app.
   • A short timeout means signing in more often, with your code. That's the price of no forgotten session staying open overnight.
   • On Never, the front-desk computer in the scene would still be open with Alba's master key.

   Source: F7, F8, F14, F19

5. 05

   Check the visitor badge

   Settings → Company → Advanced SettingsCopy path

   In a Spanish-language account: Configuración → Empresa → Advanced Settings

   On the same Advanced Settings tab, find Support Access. It lets HighLevel's team into your account to fix a problem, until a set date.

   If it's on, it shows the date support can access your account until, with two buttons: Extend access and Revoke access.

   If you have no open case with HighLevel support, click Revoke access, then click it again to confirm.

   If you do have an open case, leave it on until the case closes, and write the expiration date in your log.

   Higher up, under Enhanced Security, check that Enhanced Account Security reads Enabled. If it reads Disabled, ask AXIS Tutor before turning it on: it can affect integrations that use HighLevel's older APIs.

   Take screenshot 2: Session Timeout with your value and Support Access in view, with the browser tab showing.

   Key points

   • Support Access isn't a key for your team: it's a temporary badge for HighLevel, separate from your users. When you revoke it, access is blocked right away.
   • HighLevel's own help center says to turn it on only while it's needed and let it expire. You may find it already on, with a date months away, even if you don't remember turning it on: that's why you check.
   • Only an agency user can open a case with HighLevel support. And support doesn't make changes to your agency account without the consent of a validated agency admin or agency user.
   • Enhanced Account Security has nothing to do with signing in: it protects your sub-accounts' API keys. It ships turned on, and HighLevel warns that turning it off raises the risk.

   Source: F9, F10, F11, F7

   Your profile · one per user

   Settings → My Profile → Security

   PasswordPassword · Update password

   Two-factor authenticationWith an app and its 10 backup codes

   Sign Out EverywhereThe emergency exit

   Your agency · one for everyone

   Settings → Company → Advanced Settings

   Session TimeoutShips on Never · AXIS rule: 1 hour; 15 min on a shared computer

   Support AccessDated badge · turn on only with an open case

   Enhanced Account SecurityProtects API keys · Enabled

   No switch requires two-factor for the whole team: each person turns it on and you check

Interactive

A week with Alba Studio's keys

This interactive is used inside your AXIS account.

If it breaks

The mistakes that repeat most, and the way out.