How to require two-step verification for your staff

As the owner, you can require every owner, admin and trainer at your gym to use two-step verification (2FA). Anyone on the team without it is sent to set it up before they can use the dashboard. Members (your clients) aren't affected, and you can see who has it on from the Team sign-in security list.

Before you begin#

• You must be the gym's owner. Admins can see the setting but not change it.
• Turn on two-step verification for your own account first. See How to turn on two-step verification.
• Tell your team it's coming and that they need an authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, Authy).

Require it for the team#

1. Go to Settings → Security.
2. Find the section Require two-step verification for staff.
3. Tick Require two-step verification for owners, admins and trainers.
4. Select Save.

If you haven't turned it on for yourself, you'll see: Turn on two-step verification for your own account first, then require it for your team.

What your team sees#

The next time someone on the team without two-step verification opens the dashboard, they're sent to Sign-in & security with the message: {gym} requires two-step verification for everyone on the team. Set it up below to continue to the dashboard. Once they select Set up two-step verification and finish, they continue as normal. While the requirement is on, nobody on the team can turn their own two-step verification off.

In the Levflex app, your team sets it up from the Account tab → Sign-in & security, and signs in with a code on the Two-step verification screen. While the requirement is on, the app hides Turn off two-step verification and shows: Your gym requires two-step verification for its team, so it can't be turned off.

Check who has it on#

1. Go to Settings → Security.
2. Read Team sign-in security. Each person shows a Two-step on or Two-step off badge, and Locked if their account is locked.

Turn the requirement off#

1. Untick Require two-step verification for owners, admins and trainers.
2. Select Save. Team members who already set it up keep it on until they turn it off.

Common mistakes#

Requiring it before turning on your own#

Levflex blocks this so you can't lock yourself into a requirement you haven't met. Turn on yours first.

Not warning trainers who use the app#

The Levflex app asks for the code, but older versions can't. If a trainer says the app asks for the 6-digit code with no box to type it, they need to update the Levflex app. They can sign in on the web meanwhile.

Expecting members to need it#

The requirement covers only owners, admins and trainers. Members can turn it on for themselves from Account.

Assuming admins can change it#

Only the owner can save this setting. Admins see whether it's on.

Troubleshooting#

• Is Save greyed out or missing?
  • Yes
    You're signed in as an admin. Ask the owner.
  • No
    Go to the next question.
• Does a trainer say they lost their phone?
  • Yes
    Send them Lost your phone or recovery codes. Levflex support resets team accounts after checking who they are.
  • No
    Go to the next question.
• Does someone show Locked?
  • Yes
    See How to lock or unlock a member or staff account.
  • No
    You're done.

Each change is recorded in your gym's audit log. Your team gets the requirement message the next time they open the dashboard.