Introduction
Two-factor authentication (2FA) adds a second check on top of a password. After entering their email and password, the member also enters a 6-digit code from an authenticator app on their phone (for example Google Authenticator or Authy).
- In this article you'll learn how a club configures the 2FA policy, how a member sets up 2FA on their phone, and how club employees reset a member's 2FA. The setup steps are the same whether the member uses the Client Portal or the mobile app.
- This article will be helpful to PG Champion, Club Manager, Club Owner and Front Desk employees.
Before you start
To use 2FA, the member needs a free authenticator app on their own phone, for example Google Authenticator, Microsoft Authenticator, Authy or 1Password. Any of these works — PerfectGym does not require a specific one.
Instruction
How to enable 2FA
2FA is configured per company, with three modes:
- Setup not required – 2FA is off; members log in with just a password.
- Setup optional – members can choose to enable 2FA for their own account.
- Setup required – every member must set up 2FA; they are prompted to do so the next time they log in.
This setting only changes whether 2FA is required. If a member already has 2FA, it continues to work in every case. Members who are already logged in are not logged out or interrupted by a change — it applies on their next fresh login.
1. In PGM, go to Settings -> System Settings -> Authentication -> Two-Factor Authentication.
2. Select the desired mode: Setup is disabled, Setup is optional, or Setup is required.
3. Save. The new policy takes effect on the member's next fresh login.
How a member sets up 2FA
The steps below apply to the Client Portal and the White Label mobile apps. The separate universal PG GO mobile app (with its own login) is not part of this rollout yet.
1. The member logs in as usual with email and password.
2. If their club requires or offers 2FA, they are shown a QR code and a matching text key.
3. They open their authenticator app and either scan the QR code, or use the Can't scan? Enter this key option and type (or copy/paste) the text key. Both methods load the same secret — the QR code is just the faster option.
4. They enter the current 6-digit code and select Confirm & enable. If the club only offers 2FA (setup optional), the member can also choose Skip for now.
5. From then on, every login asks for a fresh code from the app, in addition to the password.
What if a member loses access to their authenticator app?
Please set expectations correctly with members:
- There are no recovery codes and no self-service "lost my phone" flow for members.
- If a member loses their authenticator app (new phone, uninstalled app, etc.), they must visit a club location in person.
- Club employees reset the member's 2FA in PGM, which clears the old setup so the member can pair a new authenticator app on their next login.
This approach is designed to provide stronger account security. We do not use backup methods such as recovery codes or email resets, as these could be used to bypass 2FA. If a member loses access to their authenticator app, they will need to visit the club in person to recover access to their account.
How to reset a member's 2FA:
1. In PGM, go to the Member profile for the affected member.
2. Open the Data tab.
3. Click the three-dot (⋯) menu.
4. Select Reset two factor authentication.
5. Confirm. This clears the member's existing 2FA setup — on their next login they are prompted to pair a new authenticator app (new QR code / key) from scratch.
Hints
What is an authenticator app?
A free app on the member's own phone that generates a new 6-digit code every 30 seconds. It is a standard tool that works with any service using this kind of code (banks, email providers, social media, etc.), not just PerfectGym.
Where do I get one?
From the phone's own app store — the App Store on iPhone, Google Play on Android. Well-known free options include Google Authenticator, Microsoft Authenticator, Authy and 1Password (if the member already uses it as a password manager).
Do I need to create an account with the authenticator app itself?
No, for most of them (Google Authenticator, Microsoft Authenticator) — they work standalone on the phone. Authy is the exception and asks for a phone number to back up codes across devices.
Does it need an internet connection or mobile data?
No. Once set up, the app generates codes completely offline using the phone's clock — no data connection is needed at the moment of login.
Can I use the same app for other accounts too?
Yes — one authenticator app can hold codes for many different accounts at once, each shown separately in the app.
What happens if I get a new phone?
The member needs to set 2FA up again on the new phone (scan a new QR code). Some apps offer a transfer/backup feature to move existing codes, but this varies by app. If they did not transfer it first and no longer have the old phone, that is the "lost access" case above — they visit a club so employees can reset it.