Access your Back Office at your fingertips.
Download the app now on Google Play Store.
Scan the QR code
You can also scan QR code with your phone to download the app.
How to generate recovery codes for your two-factor authentication
Updated
On this page
Introduction
Two‑Factor Authentication (2FA) adds a critical layer of security to your Lendsqr admin account by requiring both your password and a one‑time code from an authenticator app. But what happens if you lose your phone or can’t access your authenticator app?
Recovery codes (also called backup codes) are your safety net. They are single‑use codes that let you log in when your primary 2FA method is unavailable. For organizations, ensuring that admins have access to recovery codes prevents costly lockouts that could delay loan approvals, customer support, or financial operations.
This guide explains why recovery codes matter, how to generate them during 2FA setup, how to store them securely, and what to do if you lose them.
Why recovery codes matter
Scenario
Why do you need recovery codes?
Lost or stolen phone
Your authenticator app is on the device; without a backup, you cannot log in.
Factory reset without backup
Authenticator data is wiped; recovery codes are your only way back in.
Authenticator app malfunction
Rare but possible; recovery codes provide a reliable fallback.
Employee offboarding
If a team member leaves without handing over 2FA access, recovery codes allow a secure admin reset.
Having a set of recovery codes ensures business continuity. For lenders, being locked out of the admin console can mean halted operations, no loan approvals, no disbursements, no customer support. Treat recovery codes as part of your organization’s disaster recovery plan.
How recovery codes are generated
Recovery codes are created automatically when you first set up Two‑Factor Authentication on your Lendsqr admin account. You cannot generate them separately, they are only displayed at the moment you complete the 2FA setup.
If you already have 2FA active and have lost your codes, you must deactivate and then reactivate 2FA. This process generates a brand‑new set of recovery codes.
Deactivating your 2FA account
If you have already set up 2FA on your account, you would need to deactivate it to set up a recovery code. You can do this with the following steps:
Click the Settings icon (gear) at the top right of the admin console.
In the Settings sidebar, click “Two-Factor Auth” under the “Access & Security” section.
If two-factor authentication is already on, the page shows a single “Turn off” button rather than a separate menu (this replaces the older, more elaborate multi-step deactivation flow).
Click “Turn off.” A “Confirm to turn off” panel appears, asking for a 6-digit code from your authenticator app. If you no longer have access to your authenticator app, click “Lost your device? Use a recovery code” instead.
Enter the correct code (or a valid recovery code) and click “Turn off” to confirm. Two-factor authentication is now deactivated on your account.
Setting up your 2FA recovery code
Use the following steps in order to set up a recovery code for your account:
Click the Settings icon (gear), then click “Two-Factor Auth” under “Access & Security,” as shown above.
Click “Turn on.” You will be shown a QR code to scan using an authenticator app (such as Google Authenticator or Authy).
On scanning the code successfully, an entry for “Lendsqr-Admin (your admin email)” will appear on your authenticator app with a 6-digit passcode that changes every 30 seconds.
Enter the 6-digit passcode displayed on your authenticator app to complete setup.
A dialog box appears with your recovery codes, which you can copy or download into a text document. Store these somewhere safe; they are shown only once.
Note: screenshots of the QR code scan, passcode entry, and recovery-codes reveal steps are intentionally not included here. Two-factor authentication was already active on the admin account used to produce this documentation, and turning it off requires a real authenticator code or recovery code that the person producing these docs does not have access to, since it is tied to a live team member’s device. The steps above are described from the current admin console flow and the article’s original documented steps, which still hold true in substance.
