— go to the documentation home page
SubscriptionFlow documentation

Recovery Codes

Recovery codes are one-time backup codes that let a customer sign in after losing access to their two-factor method, such as a lost phone or inbox.

Available onPro

Documents version1.5.5

Last updated

On this page

What this does

When a customer enables 2FA, they can generate a set of recovery codes. Each code works once as a stand‑in for the normal one‑time code. They’re the safety net that prevents customers from being permanently locked out.

Why it exists: phones break, get lost, and email access can fail. Recovery codes keep good customers from losing access to their subscriptions.


How customers use them

  1. In the dashboard Security section, the customer enables 2FA and generates recovery codes.
  2. They save the codes somewhere safe (password manager, printed copy).
  3. If they can’t receive their normal 2FA code at login, they enter one of the recovery codes instead.
  4. Each code is single‑use; once used, it’s gone.

Tips & Best Practices

  • Prompt customers to save codes immediately after enabling 2FA — before they close the screen.

  • Recommend a password manager as the safest place to store them.

  • Regenerate if compromised. If a customer thinks their codes were seen by someone else, they can generate a fresh set (which invalidates the old ones).

  • Watch the low‑codes warning. When only a few codes remain, customers should generate a new batch.


Frequently Asked Questions

Are recovery codes available on the Free plan?

No — they’re part of the Pro security features and work alongside 2FA.

How many times can I use a recovery code?

Each code works once. Generate a new set when you’re running low.

What if a customer loses their recovery codes too?

An admin can help restore access. Encourage customers to store codes safely to avoid this.

Do recovery codes expire?

They remain valid until used or until the customer regenerates a new set (which replaces the old ones).

Where do customers find them?

In the Security section of the customer dashboard, after enabling 2FA.

Should every customer generate them?

Yes — anyone using 2FA should keep recovery codes as a backup.