> For the complete documentation index, see [llms.txt](https://support.ordereazi.com/central/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.ordereazi.com/central/getting-started/signing-in-and-security.md).

# Signing in and security

Your OrderEazi account holds your clients, prices, and documents, so it's worth keeping safe. This page covers signing in to OrderEazi Central, resetting a forgotten password, and multi-factor authentication (MFA), which asks for a code from your phone as well as your password.

### Before you start

Your OrderEazi administrator creates your account and sets your first password. You'll get an email with the subject "Verify your Account". Select the link in it to confirm your email address, because you can't sign in until you have.

### How to sign in

1. Go to your organisation's OrderEazi address, for example yourcompany.ordereazi.com.
2. Enter your email address in **Email address**. Your email address is your username.
3. Enter your password in **Password**.
4. Select **Login**.

If MFA is set up on your account, OrderEazi asks for a code next. Otherwise, OrderEazi opens straight away.

If your organisation uses single sign-on (SSO), where you sign in with your company account instead of a separate OrderEazi password, select **Sign in with SSO** and sign in with your company account.

### When you can't sign in

* **"The username and password combination is incorrect. Please try again.":** Check your email address and password. If you've forgotten your password, reset it (see below).
* **"E-mail address has not been confirmed.":** Select the link in your "Verify your Account" email first. If you can't find the email, ask your administrator.
* **"This account has been disabled.":** Your administrator has turned off your account. Ask them to turn it back on.
* **"Account Locked":** After 3 wrong attempts in a row, your account is locked for 10 minutes. Wrong MFA codes count as wrong attempts too. Wait 10 minutes, then try again.
* **"Account Not Found" after signing in with SSO:** Your company account worked, but there's no OrderEazi user for you yet. Ask your administrator to add you.

### How to reset your password

1. On the sign-in page, select **Forgot password?**.
2. Enter your email address in **Email address**.
3. Select **Send reset link**.
4. Open the email with the subject "Reset Password" and select the link in it.
5. Enter your email address in **Email address**.
6. Enter your new password in **New password** and again in **Confirm new password**.
7. Select **Reset password**.

You see "Your password has been reset successfully. You can now log in with your new password." Select **Login** to sign in.

OrderEazi shows "Check your email" after step 3 whether or not the address has an account. If no email arrives within a few minutes, check your spam folder. If your organisation sends password changes to a manager, you're told that an email has been sent to your manager instead.

#### Password rules

A new password must be at least 12 characters long and contain an uppercase letter, a lowercase letter, a number, and a symbol. OrderEazi also refuses passwords on a list of the 100 000 most common ones, with the message "The password you chose is too common."

**Example:** "Summer2026!" is refused, because it's only 11 characters long. A longer phrase such as "Blue-Kettle-Ridge-42" meets every rule and is easier to remember.

### How to set up multi-factor authentication

You'll need an authenticator app on your phone. It shows a six-digit code that changes every few seconds, and OrderEazi asks for that code when you sign in.

1. Select your name or initials at the top of the page.
2. Select **Security & MFA**.
3. Under **Two-factor authentication**, select **Enable MFA**.
4. Scan the QR code with your authenticator app. If you can't scan it, type the **Manual setup key** into the app instead.
5. Enter the six-digit code the app shows in **Verification code**.
6. Select **Verify and enable MFA**.

You see "Multi-factor authentication is now set up on your account." and a list of 10 recovery codes. Each recovery code signs you in once if you don't have your phone. They're not shown again, so select **Copy all** or **Print** and keep them somewhere safe. Then select **I've saved them - go to dashboard**.

### How signing in with MFA works

After you enter your password, OrderEazi asks for a code. You can give it in one of three ways:

* **A code from your app:** Enter the six-digit code from your authenticator app and select **Verify and sign in**.
* **A code by email:** Select **Email me a code instead**. OrderEazi emails a six-digit code with the subject "Your sign-in verification code". The code works for 5 minutes, and you can ask for a new one after 60 seconds.
* **A recovery code:** Tick **Use a recovery code instead** and enter one of the codes you saved. Each recovery code works once.

Tick **Remember this device for 30 days** if you don't want to be asked for a code on that device for the next 30 days.

To see how many recovery codes you have left, go to **Security & MFA**. It shows **Recovery codes remaining**, and warns you when you're down to 2 or fewer. Select **Regenerate recovery codes** to get a new set of 10.

### When your organisation requires MFA

Your administrator can require MFA for everyone. If you haven't set it up, OrderEazi takes you to the MFA setup screen the next time you use it, with the message "Your organization requires multi-factor authentication. Set it up below to continue using OrderEazi Central." You can't use the rest of OrderEazi until you've finished setting it up.

#### How to require MFA for everyone

You'll need the **Organization Setup** permission, in the **Settings** permission group. Set up MFA on your own account first. OrderEazi won't let you require it until you have, so you don't lock yourself out of settings.

> **Warning:** The setting applies to every user as soon as you save. Anyone without MFA is stopped the next time they open a page, until they set it up.

1. In the main menu, go to **Settings** > **Organization Setup**.
2. Select the **Configuration** tab, then the **System Settings** tab.
3. Scroll down to the **Security** section.
4. Tick **Require Multi-Factor Authentication**.
5. Select **Yes, require MFA**.
6. Select **Save**.

To warn people before they're stopped, select **Email un-enrolled users to set up MFA**, then **Send**. This button needs the **Manage Users** permission, and only works once the setting is saved. You see "Enrolment email sent to" followed by the number of users. Each of them gets an email with the subject "Action required: set up multi-factor authentication".

### How to turn off multi-factor authentication

1. Select your name or initials at the top of the page.
2. Select **Security & MFA**.
3. Under **Turn off multi-factor authentication**, enter a code from your authenticator app. If you don't have your phone, select **Email me a code instead** and enter the code from the email.
4. Select **Turn off MFA**.

You see "Multi-factor authentication has been turned off for your account." If your organisation requires MFA, you can't turn it off, and you see "Your organization requires multi-factor authentication, so it cannot be turned off on this account."

### Signing out

Select your name or initials at the top of the page, then select **Sign Out**. OrderEazi also signs you out after an hour without any activity. It doesn't warn you first, so save your work before you step away.

### Related pages

* [Finding your way around](/central/getting-started/finding-your-way-around.md): learn the menus once you're signed in
* [Users](/central/order-management/settings/manage-users/users.md): add users and manage their accounts
* [Security options](/central/order-management/settings/organization-setup/system-settings/security-options.md): make MFA required for everyone in your organisation