Security · New
Two-step verification your way
The email code is still there for everyone. Now each person can add an authenticator app or passkeys, which are faster and safer, and keep recovery codes for the day they lose their phone.
1Authenticator app
The code comes from your app.
1Password, Google Authenticator or another. Six digits that change every 30 seconds, with no waiting for an email.
A password isn't enough to protect salaries
Selfcare holds NIF (tax number) and IBAN details, payslips and sick notes. That's why every sign-in already asks for a second step. The email code works for everyone, but it sends you to your inbox and leaves the account only as safe as the email. If you want more, now you have a choice.
When you sign in
You pick the method, and there's always another
It opens on the method you chose as your main one. If you don't have the app to hand today, click Use another method and sign in another way. The email code is always on the list.
- You choose the default method in Settings, Security
- With the app or a passkey as your main method, no email is sent at all
- Trust this device for 30 days works with any method
- On your phone too: the passkey uses Face ID or your fingerprint
A 30-minute demo with your own data imported live.
In Settings, Security
On in a minute, without asking anyone
Each person sets up their own methods. For the authenticator app, scan the QR code or type the key by hand, then confirm with the first code: only then is it active. For passkeys, give each one a name so you can recognise it later.
- Works with 1Password, Google Authenticator, Microsoft Authenticator and other apps
- Several passkeys, for example one on your computer and another on your phone
- Removing a passkey or the app takes one click, always with email as the safety net
- Adding, removing or changing a method asks you to confirm it's you within the last 10 minutes
Recovery codes
Losing your phone doesn't mean losing access
When you turn on the authenticator app or your first passkey, Selfcare gives you ten recovery codes. Keep them in a password manager or print them, and they're there for the day you need them.
Shown once
You only see them at the moment they're created. After that not even we can read them: we keep only an irreversible digest of each one.
Each one works once
A used code stops working. The screen shows how many you have left, and you can generate ten new ones whenever you want.
New codes cancel the old ones
If you think someone saw your sheet, generate new codes and the previous ones stop working instantly.
Built for people trying to get in uninvited
Passkeys tied to Selfcare
A passkey only responds on app.selfcare.work. On a fake site imitating ours, it simply doesn't work.
Codes that don't repeat
The authenticator app's secret is encrypted. Each code works only once, and a used code is refused, even within the 30 seconds.
Attempts counted
There are attempt limits per account and per address, so guessing codes gets nowhere.
Never locked out
The email code can't be removed. Nobody gets locked out of their account for changing phones.
Changes confirmed
Adding or removing a method, changing the main one or generating new codes asks for a recent confirmation. A forgotten open session isn't enough.
Everything logged
Every method added or removed and every recovery code used goes in the audit log, with no codes or secrets.
See Selfcare with your data
Frequently asked questions
Do I have to stop using the email code?+
No. The email code stays available to everyone and can't be removed. The app and passkeys join it.
Which authenticator apps work?+
Any app that follows the TOTP standard: 1Password, Google Authenticator, Microsoft Authenticator, Authy, Bitwarden and others. Scan the QR code or type the key by hand.
What is a passkey?+
It's a way to confirm it's you with what your device already uses to unlock: fingerprint, face or PIN. It's stored on your computer, your phone or a physical key, and it only works in Selfcare.
I lost my phone. How do I sign in?+
With one of your recovery codes, or with the email code. Then, in Settings, Security, remove the app or the passkey from the lost phone.
Does the company have to turn anything on?+
No. Each person chooses their methods in their own settings. Two-step verification was already mandatory for everyone and still is.
Does it cost anything?+
No. It's included in every plan, for everyone.
Sign in fast, without making it easy for the wrong people
In a 30-minute demo we show how each person turns on the authenticator app or a passkey, and what happens when they lose their phone.