Multi-factor authentication (MFA) FAQs

Get answers to frequently asked questions about multi-factor authentication (MFA).

Where do I get my MFA code?

It depends on whether you set up MFA via SMS or an authenticator app:

• SMS: click Send SMS code on the SMS Verification screen to have a code texted to your registered phone number.
  • If you change your phone number, you must disable SMS MFA and set it up again with your new number. See the section on resetting MFA below before disabling it.
• Authenticator app: your code appears in the app, whether you use a desktop, web, browser-based, or mobile app.

If both SMS and an authenticator app are set up, Klaviyo shows the last MFA method you used. If you haven't used either yet, it starts with the authenticator app. An authenticator app is considered more secure. To switch methods, select Log in with other MFA method, then choose the other method.

Enter the code into Klaviyo, then click Verify code for SMS or Log in for an authenticator app.

What is the difference between a trusted device code and MFA?

In both cases, the goal of these codes is to check that you are who you say you are.

When you log in with your email and password, Klaviyo asks for an MFA code if you have MFA enabled. If you don't have MFA enabled, it checks whether your browser is trusted and sends an email code if it isn't.

The other key difference is where you get this code. When checking if a device should be trusted, Klaviyo sends the code via email. For MFA, the code is sent via text message or appears in your authenticator app, depending on which method you’re using.

How can I reset my MFA?

Depending on which method you’re using, you may need to reset MFA when you change phone numbers or if you lose access to your app.

If you have access to a paid account or any account that requires MFA, set up another MFA method before disabling your current one. You must also keep an MFA method while you have a passkey registered.

If you are logged in to Klaviyo and can complete the verification step, you can disable and set up an MFA method again. You’ll need a valid authentication code or an unused authenticator-app backup code to disable a method. For step-by-step instructions, see our dedicated article on setting up MFA.

If you can't verify your MFA method, even if you are still logged in, see the next section.

What do I do if I have lost my phone or backup codes?

If you can still use another MFA method you already set up or an unused authenticator-app backup code, try that first.

If you cannot complete MFA verification, ask an Admin or Owner on your account to reset your MFA for you. Complete the reset using the confirmation email Klaviyo sends you, then set up MFA again when prompted.

If you are the sole Owner or Admin on the account, or the Owner and Admin are unavailable, you can also submit an account access request to Klaviyo Support. This will require you to verify your identity and may take several days.

What are backup codes and how do I use them?

If you downloaded backup codes when setting up MFA via an authenticator app, these codes will let you log in to Klaviyo. Please note that these codes:

• Can only be used 1 time.
• Cannot be used as a backup method for SMS MFA.

1. If both methods are enabled and you are on SMS Verification, select Log in with other MFA method > Log in using authenticator app. On the authenticator-app MFA screen, select Enter backup code instead.
2. Enter an unused backup code, then click Enter backup code to log in.

If your backup codes are not working, please make sure you:

• Are using the correct backup codes (not a set intended for a different application).
• Haven’t already used these codes before.

Why is my account asking me to log in with MFA if I never set it up?

A few things may be at play here:

• You may have set up MFA at one point and forgotten, so check:
  • Your mobile device to see if you got a text with the code.
  • Any authenticator apps you may have on your device to see if “Klaviyo” shows up on any of them.
  • If you can’t find the code anywhere, please see the section on resetting your MFA.
• You’re sharing login credentials and someone else set up MFA without you knowing.
  • If this is the case, we recommend talking with your account Owner or Admin to make sure each person using Klaviyo has their own login. See how to add users in Klaviyo.

It keeps saying my code is incorrect

A common reason for this error is that there’s a mismatch between the time used for your authenticator app and the actual UTC time.

Authenticator apps create a time-based one-time password (TOTP), which relies on UTC time to create the codes. If your device’s clock is incorrect, the code can be rejected even when you enter it correctly.

Set your device’s date and time to update automatically, then enter a fresh code from the Klaviyo entry in your authenticator app. If SMS MFA is already set up for your login, you can switch to it instead.

If Klaviyo says your account is temporarily locked because of too many authentication attempts, wait 5 minutes before trying again.

Why is my SMS MFA code not sending?

Click Send SMS code on the SMS Verification screen. If the code does not arrive, wait until Resend code is available, then click it to try again.

Please check that:

1. You’re using the same phone number you set up SMS MFA with.
   • If you changed numbers recently or are using your work phone instead of your personal phone, it might be sending to your other device.
2. Your device has service. If your provider cannot receive text messages, then it cannot receive the SMS MFA code needed to verify your identity.
   • Double check there isn’t an outage in your area as well.
3. If you are using a VOIP or a landline, your texts likely will not arrive. Please try using a standard mobile device, or use an authenticator app as your MFA method.
   • We do not support landlines or third-party VOIP services that allow you to send and receive calls and texts over the internet.

Additional resources