Skip to main content
Who can use this?
  • All Gallabox users can enable 2FA on their own account.
  • Only Admins can enforce 2FA for all team members.
  • Roles: Owners and Admins (for team-wide enforcement)
Two-Factor Authentication (2FA) adds a second verification step when logging in. Even if someone knows your password, they can’t access your account without also having access to your second factor (email or a TOTP authenticator app). 2FA is mandatorily enforced for Owners and Admins. We strongly recommend enabling 2FA on your account.

​
Why Enable 2FA?

Without 2FA, your account is protected by only one factor — your password. If someone guesses or steals your password, they have full access to your Gallabox account, including:
  • All customer conversation data
  • All connected channels (WhatsApp, Instagram, Web Chat)
  • All integrations (Shopify, HubSpot, payment data)
  • All bot flows and automation settings
2FA makes this significantly harder — even with your password, an attacker needs your second factor to log in.

​
Supported 2FA Methods

​
Enabling 2FA on Your Account

1

Go to Two-Factor Authentication

Go to your Profile section
2

Choose a method

Choose Setup Email Authentication or Setup TOTP.
3

Complete verification

  • For Email Authentication, enter the verification code sent to your account email address.
  • For TOTP Authentication, scan the QR code with your authenticator app and enter the code shown in the app.
4

Save your recovery codes

For TOTP setup, save the recovery codes shown after verification. Copy or download them to a safe place, such as a password manager or encrypted note.

​
Recovery Codes

Recovery codes are one-time use codes that let you log in if you lose access to your authenticator app. Gallabox shows your recovery codes when you set up TOTP — save them at that point; they aren’t shown again. Important:
  • Each code can only be used once
  • Store them securely — in a password manager, encrypted document, or safe location
  • Never share recovery codes with anyone

​
Logging in with 2FA

After enabling 2FA, every time you log in:
1

Enter your login details

Enter your email and password as usual
2

Enter the 2FA code

You’ll be asked for a 6-digit code
3

Get the verification code

  • For Email Authentication, open the verification email and enter the code.
  • For TOTP Authentication, open your authenticator app, find Gallabox, and enter the current code.
4

Verify

Click Verify → you’re logged in
Tip: TOTP authenticator codes refresh automatically. Enter the current code before it changes.

​
Enforcing 2FA for Your Team

As an Admin, you can require all team members to enable 2FA:
1

Open the Users, Teams and Roles settings

Go to Settings → Workspace → Users, Teams and Roles
2

Enable the team requirement

Toggle Enforce 2FA to all
3

Confirm the action

Confirm the action — this will prompt all non-2FA users on their next login

​
Enforcing 2FA for an individual member

You can also enforce 2FA for a single team member: open the three-dot menu on that user in Settings → Workspace → Users, Teams and Roles and choose the enforce option. Once enabled, the Owner or Admin can reset that user’s 2FA. After a reset, the user picks their preferred 2FA type at their next login.

​
If You Lose Your 2FA Device

​
Method 1: Use a recovery code

1

Open the recovery code option

On the 2FA code entry screen, click “Use a recovery code” (below the code entry field)
2

Enter a saved code

Enter one of your saved recovery codes
3

Set up 2FA again

You’re logged in — immediately go to your Profile section and set up 2FA on your new device

​
Method 2: Contact support to reset 2FA

If you’ve lost both your device and recovery codes:
1

Contact support

Contact Gallabox support — provide your account email and billing information to prove ownership
2

Wait for the reset

Gallabox support will manually reset your 2FA
3

Enable 2FA again

Once reset, log in and enable 2FA again on your new device

​
Managing 2FA Settings

​
Resetting a team member’s 2FA

An Owner or Admin can reset a user’s 2FA:
1

Open the user's menu

Go to Settings → Workspace → Users, Teams and Roles and open the three-dot menu on that user
2

Reset 2FA

Choose the reset option
3

The user re-enrolls

At their next login, the user picks their preferred 2FA type and sets it up again

​
If your recovery codes are unavailable

Recovery codes are generated and displayed during TOTP setup. If the saved codes are no longer available, ask an Owner or Admin to reset 2FA and complete TOTP setup again.

​
Disabling 2FA

There is no direct option to disable 2FA from your account. If you need to change your 2FA setup, ask an Owner or Admin to reset your 2FA (via the three-dot menu on your user in Settings → Workspace → Users, Teams and Roles) — you’ll then pick your preferred 2FA type at your next login.

​
FAQs

Gallabox supports TOTP-based 2FA, which includes hardware keys that support the TOTP protocol (like YubiKey with Yubico Authenticator). Dedicated FIDO2/WebAuthn hardware keys (like YubiKey security key mode) are not currently supported. For the highest security with Gallabox, use an authenticator app like Google Authenticator or Authy.
No — 2FA only affects web and mobile app logins. API keys and integration OAuth connections are not affected by 2FA. Your bot flows, integrations, and API calls continue to work normally.
If 2FA is enforced for a team member, they must complete 2FA setup before they can continue using Gallabox — they’ll be held at the setup screen on login. They can complete it with Email Authentication or TOTP Authentication. You, as Admin, cannot enable 2FA on their behalf — they must set it up themselves.
Yes — your authenticator app (Google Authenticator, Authy, etc.) can store multiple accounts. Each Gallabox account you log into will add a separate entry. Keep them named clearly so you know which code belongs to which Gallabox account (e.g., “Gallabox - Work” vs “Gallabox - Personal”).