Signing in with two-factor authentication is required for all Harvest accounts that integrate with Xero, because of Xero’s security requirements.

This feature is currently available only to Harvest accounts using the Xero integration. The option to require 2FA in your account will only be visible once you start the Xero connection process, or if your account is already connected to Xero.

Two-factor authentication (2FA), sometimes referred to as two-step verification or dual-factor authentication, is a security process that requires two different authentication factors to sign in to an account. 2FA better protects both a person's credentials and the resources they can access. In this case, in addition to your password or Google Sign-In, you’ll need to use a code (either from an authenticator app or sent to your email) to sign in to Harvest, wherever you use it—including the web app, mobile apps, and desktop apps.

This article focuses on enabling, disabling, and troubleshooting two-factor authentication. We also have a 2FA FAQs article that might help answer other questions around 2FA.

Enabling two-factor authentication

Requiring two-factor authentication for everyone in your account

Only Administrators can set a Harvest account to require 2FA, and only during the Xero connection process. You won’t be able to require 2FA ahead of time.

Once 2FA is required, everyone in the account will be signed out and must complete 2FA setup for their own profile before they can continue using Harvest (and any connected Forecast account).

Connecting to Xero and enabling 2FA

1. In Harvest, go to your Settings.
2. Scroll down to Integrations > Accounting and click the link to enable two-factor authentication.
   • You won’t see this option if your invoices module isn’t enabled.
3. On the Edit preferences page you’re taken to, check the box for Require two-factor authentication… in the Sign in security section, then click Save preferences.
   • You’ll then be taken to the Security section of your Harvest ID. Before moving on to the next step, set up two-factor authentication for your individual profile here. Everyone else in your company’s account will also need to set this up for themselves the next time they access the account.
   • Once you’ve signed back in to your account, you’ll be brought back to Settings in Harvest.
4. In Settings, scroll down to Integrations and click the link to connect to Xero once more. You’ll be taken to Xero.
5. Once signed in to Xero, select which organization Harvest should copy invoices to and click Allow access. You’ll be redirected back to Harvest.
6. In Harvest, select your default revenue and payment accounts for Xero (if you opt in to copy invoice payments from Harvest to Xero), as well as your tracking category setting.
7. Click Save.

Setting up two-factor authentication for your profile

You can only set up 2FA for your own profile once the requirement has been enabled for the whole Harvest account, as described in the previous section.

Regardless of permissions, everyone in an account where 2FA is required will be signed out and must complete the 2FA setup for their own profile before they can continue using Harvest (and any connected Forecast account).

If you’re the Administrator setting up a new Xero connection, you must complete your own 2FA setup during the Xero connection process, before continuing. Everyone else in the account can click the link in the email they’ll receive or go directly to https://id.getharvest.com/security.

1. Sign into Harvest at https://id.getharvest.com.
2. Scan the QR image with your preferred authenticator app, or request a code via email.
3. Once you’ve received the code (in your authenticator app or email), enter that code in the designated field.
4. After you’ve entered your code, click Complete set up.
   • You’ll see a confirmation message at the top of Harvest ID letting you know two-factor authentication has been enabled. You’ll now be able to access your account again.

Disabling two-factor authentication

Disabling the two-factor authentication requirement for everyone in your account

Only Administrators can remove the 2FA requirement, and they can only do so if the account is no longer connected to Xero. All Administrators on the account will receive an email notifying them that the requirement has been disabled.

1. Disconnect from Xero.
2. Go to your Settings. 
3. Under Preferences, click Edit preferences. 
4. In the Sign in security section, uncheck the box next to Require two-factor authentication (2FA) for this account.
5. Click Save preferences.

This will turn off the requirement for 2FA, but individuals who want to disable sign-in with 2FA for their own profile will need to do that manually following the steps below.

Turning off two-factor authentication for your profile

You’ll only be able to turn 2FA off for yourself if your organization’s Harvest account is no longer connected to Xero and an Administrator has removed the 2FA requirement for the whole account.

1. Head to Harvest ID (https://id.getharvest.com). 
2. Select Security in the top menu. 
3. In the Two-factor authentication section, click the red Disable button.
4. On the next screen, enter your Harvest ID password and click Confirm password.
   • You’ll see a confirmation message at the top of Harvest ID letting you know two-factor authentication has been disabled.
5. We recommend then deleting Harvest from your authenticator app, as you’ll need to scan a new image if you enable 2FA again later on.

Troubleshooting

If you’ve forgotten your password, you can reset it with the steps in our article on changing your password.

If you set up your 2FA to use an authenticator app and have lost access to that authenticator app, you can choose to send a code to your email instead. You can then continue using email codes whenever you sign in, or you can set up a new authenticator app. To add a new authenticator app, go to the Security section of https://id.getharvest.com, click the green Review two-factor authentication button, and scan the image with your app.

If you set up your 2FA to use email codes only and have lost access to the email address you use to sign in to Harvest, please reach out to us at support@harvestapp.com.

If you can’t sign in to the Mac or Windows desktop app, you’ll need to first update to the latest version of the app, which has 2FA capability.

Other questions

We have answers to some frequently asked questions, including how 2FA works with Google Sign-In or if you belong to multiple Harvest/Forecast accounts, in our 2FA FAQs article.