Multi-Factor Authentication - Everything you need to know

Cloudbeds uses multi-factor authentication (MFA) to provide a strong and flexible security solution for your account. MFA adds an important layer of protection, making it significantly more difficult for unauthorized individuals to access your account and sensitive information.

You can choose from several authentication methods based on your devices, security needs, and preferred login experience.

  You do not need to be technical to use MFA. You can change your authentication method at any time or reset multi-factor authentication when needed.

Additional verification for sensitive actions

Some sensitive actions in the Cloudbeds Dashboard require an additional identity check, known as step-up MFA. This extra verification helps protect important account settings and property data, even when a user is already signed in.

After the first 10 minutes of your session, the normal verification process applies. When you attempt a sensitive action, you may be asked to complete an MFA verification before continuing.

Sensitive actions include:

• Exporting reservations to an XLS file
• Resetting your own MFA method
• Resetting another user's MFA method, when permitted
• Editing custom JavaScript or HTML in the Booking Engine

After you successfully complete step-up MFA, the verification remains valid for 8 hours, provided that you continue using the same user account, property, and network.

Choose an MFA method

Select the authentication method that provides the best balance of security and convenience for your setup.

Which method is right for you?

Our top recommendations

We recommend the following methods for the best balance of security and ease of use.

1. Social login with Apple or Google

One of the simplest ways to securely access Cloudbeds is to link your existing Apple or Google account.

• Why choose this method? You can use the secure login method you already use with Apple or Google instead of managing another separate login method.
• Easy to use: After setup, select the corresponding Apple or Google option when you sign in.

Setup instructions:

• Set up Apple Login
• Set up Google Login

2. Passkeys: The gold standard

A passkey is a highly secure way to log in. Think of it as a digital key stored on your device.

• How it works: Instead of entering a password, you approve your login using the method you already use to unlock your phone or computer, such as your fingerprint, Face ID, or device PIN.
• Phishing-resistant: A passkey is linked to the legitimate Cloudbeds website and cannot be entered into a fraudulent login page like a password or verification code.
• Private: Your biometric information, such as your fingerprint or face scan, remains on your device and is not shared with Cloudbeds.

3. Authenticator apps

An authenticator app, such as Google Authenticator, Okta Verify, Microsoft Authenticator, or 1Password, generates a six-digit verification code that changes approximately every 30 seconds.

• Why choose this method? Even if someone obtains your password, they generally cannot access your account without the current verification code from your authenticator app.
• Works without SMS: The verification code is generated directly in the app and does not rely on a text message.

Alternative MFA methods

If the recommended options above do not fit your setup, you can also use another supported MFA method.

• Okta Verify
• Google Authenticator or another TOTP authenticator app, such as Microsoft Authenticator or 1Password
• Other supported MFA methods
• SMS, Email, and Voice are now available to all users as verification and account recovery options. All users have also been automatically enrolled in Email verification as a fallback — if you lose access to your primary MFA device, your registered email can be used to recover access. These methods are available but not recommended as a primary login method due to the security limitations described above.