About two-step verification (2SV)

<body>
<p id="docs-hc-snippet" style="display: none;">Two-step verification (2SV) is a security protocol that enhances protection by requiring a passcode when signing in from a new or unrecognized device. It ensures that the credentials used are associated with a legitimate user.</p>
<div class="article-banners">
<div id="docs-wmp-link">
<a href="https://support.zendesk.com/hc/en-us/articles/5411234991258-plan" rel="noopener" target="_blank">What's my plan?</a>
</div>

<div class="article-banner" id="suite_all">
<table>
<tbody>
<tr>
<td>
<strong>All Suites</strong>
</td>
<td>Team, Growth, Professional, Enterprise, or Enterprise Plus</td>
</tr>
</tbody>
</table>
</div>

<div class="article-banner" id="support_all">
<table>
<tbody>
<tr>
<td>
<strong>Support</strong>
</td>
<td>Team, Professional, or Enterprise</td>
</tr>
</tbody>
</table>
</div>

</div>
<div id="docs-ai-summary">
<p id="docs-ai-summary-toggle">Summary: <span id="up-triangle">◀</span><span id="down-triangle">▼</span></p>
<p id="docs-ai-summary-content">Two-step verification adds security by requiring a passcode when signing in from new devices using email and password. Passcodes are emailed, expire in ten minutes, and must be entered to complete sign-in. Devices are tracked with a cookie to avoid repeated prompts. Admins can generate recovery codes if needed. This feature applies to team members and does not affect end users.</p>
</div>

<div class="body">

<p class="p">Two-step verification (2SV) is a security protocol that enhances protection by requiring
a passcode when signing in from a new or unrecognized device. It ensures that the
credentials used are associated with a legitimate user.</p>
<p class="p">Two-step verification is active for all accounts using the <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408887573274#topic_v1w_jsl_v3" target="_blank">standard Zendesk sign-in</a> (email and password)
for team members and cannot be turned off. This feature does not impact end users.</p>
<p class="p">When signing in from a new device, team members are emailed a passcode, which they must
use to complete the sign-in. If <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408826974874" target="_blank">two-factor authentication</a> is turned on or team members sign
in with single sign-on (SSO), they aren’t prompted for a passcode.</p>
<p class="p">If team members can't retrieve their passcode and can’t sign in to Zendesk, a Zendesk
admin or account owner can <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/8197977742874" target="_blank">generate a recovery code</a> to help them regain access to their
account. </p>
<div class="p">This article covers the following topics:<ul class="ul" id="two_step_verification__ul_wwy_tp4_hwb">
<li class="li"><a class="xref" href="#topic_x51_1dh_zcc">Understanding how two-step verification works</a></li>
<li class="li"><a class="xref" href="#topic_bjj_jhy_1dc">Understanding the sign-in experience with two-step verification</a></li>
</ul>
</div>
<div class="p">Related articles:<ul class="ul" id="two_step_verification__ul_f2w_kq4_hwb">
<li class="li"><a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408824378650" target="_blank">Zendesk In-Product Cookie Policy</a></li>
<li class="li"><a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408888782618" target="_blank">General security best practices</a></li>
</ul>
</div>
</div>
<div aria-labelledby="ariaid-title2" class="topic nested1" id="topic_x51_1dh_zcc">
<h2 class="title topictitle2" id="ariaid-title2">Understanding how two-step verification works</h2>
<div class="body">
<p class="p">For added security, Zendesk <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408834578074" target="_blank">tracks the devices</a> used to access your account using a
cookie named <code class="ph codeph">_zendesk_cookie</code>. The first time any team member signs
in using the standard Zendesk sign-in (email and password) and passcode, the
application stores the <code class="ph codeph">_zendesk_cookie</code> on the device.</p>
<p class="p">Zendesk checks the <code class="ph codeph">_zendesk_cookie</code> when team members sign in. If the
<code class="ph codeph">_zendesk_cookie</code> doesn't exist or is invalid, Zendesk deems that
device as new and will prompt the agent for a passcode. If the cookie is valid, team
members who have signed in on the device before are not prompted for a passcode.
However, team members who haven’t signed in on the device are prompted for a
passcode.</p>
<p class="p">Additionally, using incognito mode or clearing the browser cache and cookies can
cause Zendesk not to recognize the <code class="ph codeph">_zendesk_cookie</code>.</p>
<p class="p">When using two-step verification, passcodes are sent to the team member’s <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/6735805091098" target="_blank">primary email address</a> listed in their Zendesk profile.
Passcodes expire after ten minutes and can only be used once. If team members enter
an invalid or expired passcode, Zendesk emails them a new one.</p>
<p class="p">Two-step verification passcode emails are sent from the <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/5279521301914#topic_btc_h1f_bwb" target="_blank">default support address</a> of your default
brand. If it's an external email address and the connection is broken, the passcode
email won't be sent.</p>
</div>
</div>
<div aria-labelledby="ariaid-title3" class="topic nested1" id="topic_bjj_jhy_1dc">
<h2 class="title topictitle2" id="ariaid-title3">Understanding the sign-in experience with two-step verification</h2>
<div class="body">
<p class="p">This procedure illustrates the typical workflow when team members sign in to Zendesk
from a new or unrecognized device.</p>
<ol class="ol" id="topic_bjj_jhy_1dc__ol_hqm_qwx_1dc">
<li class="li">The team member signs in to their Zendesk account using their email and password
and clicks <strong class="ph b">Sign in</strong>.<p class="p">If Zendesk doesn’t recognize the device, the
Two-step verification dialog will appear, instructing the team member to
retrieve a passcode from their email.</p>
<p class="p"><img class="image img-screenshot" id="topic_bjj_jhy_1dc__image_jxw_khy_1dc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/2SV_passcode_prompt.png" width="300"></p>
</li>
<li class="li">The team member checks their inbox for an email from Zendesk. <p class="p">The email
includes the subject <strong class="ph b">&lt;your account name&gt; verification passcode</strong> and
a passcode that’s valid for ten minutes.</p>
<p class="p"><img class="image img-screenshot" id="topic_bjj_jhy_1dc__image_kxw_khy_1dc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/2SV_passcode_email_10.png" width="300"></p>
</li>
<li class="li">The team member pastes the passcode into the <strong class="ph b">Passcode</strong> field in the
Two-step verification dialog and clicks <strong class="ph b">Verify</strong>.<p class="p">If the team member
enters an invalid or expired passcode, Zendesk automatically sends them
another passcode instead of signing them in.</p>
</li>
</ol>
</div>
</div>
<script id="docs-schema-markup" type="application/ld+json">{
"@context": "https://schema.org",
"@type": "TechArticle",
"@id": "https://support.zendesk.com/hc/en-us/articles/8197975442330-About-two-step-verification-2SV",
"url": "https://support.zendesk.com/hc/en-us/articles/8197975442330-About-two-step-verification-2SV",
"headline": "About two-step verification (2SV)",
"description": "You can enhance account security by using two-step verification, which requires a passcode sent to your email when signing in from a new or unrecognized device, and recovery codes can be generated if access is lost.",
"articleSection": "User sign-in",
"datePublished": "2024-10-14T23:38:31+00:00",
"dateModified": "2026-04-09T16:33:54.583415+00:00",
"inLanguage": "en-US",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://support.zendesk.com/hc/en-us/articles/8197975442330-About-two-step-verification-2SV"
},
"author": {
"@type": "Organization",
"name": "Zendesk",
"url": "https://www.zendesk.com"
},
"publisher": {
"@type": "Organization",
"name": "Zendesk"
},
"isPartOf": {
"@type": "WebSite",
"name": "Zendesk Help",
"url": "https://support.zendesk.com/hc/en-us"
},
"about": {
"@type": "SoftwareApplication",
"name": "Zendesk"
}
}</script><script id="ai-summary-script">
//<![CDATA[
const ai_summary_style = document.createElement('style');
ai_summary_style.innerHTML = `#styled-article-body{padding:0 0 0}#article-body #docs-ai-summary{background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 6px;margin-bottom:16px}#article-body #docs-ai-summary #docs-ai-summary-toggle{font-size:.9em;font-weight:700;margin-bottom:4px;cursor:pointer;display:flex;justify-content:space-between;align-items:center}#article-body #docs-ai-summary #docs-ai-summary-toggle #up-triangle{margin-left:auto;padding-right:10px;display:none}#article-body #docs-ai-summary #docs-ai-summary-toggle #down-triangle{margin-left:auto;padding-right:10px}#article-body #docs-ai-summary #docs-ai-summary-content{font-size:.9em;padding-left:25px;padding-right:25px;margin-bottom:12px}`;
document.head.appendChild(ai_summary_style);

const toggleAISummary = () => {
const summary = document.getElementById("docs-ai-summary-content");
const upTriangle = document.getElementById("up-triangle");
const downTriangle = document.getElementById("down-triangle");
if (summary.style.display === "none") {
summary.style.display = "block";
upTriangle.style.display = "none";
downTriangle.style.display = "inline";
} else {
summary.style.display = "none";
upTriangle.style.display = "inline";
downTriangle.style.display = "none";
}
};

document.getElementById("docs-ai-summary-toggle").addEventListener("click", toggleAISummary);
//]]>
</script>
</body>