Google Two-Factor Authentication (2FA) for Krayin CRM

Google2FA Configuration Settings sit under Configuration > Security > Google2FA. Three switches control how it behaves for every staff member.

The same screen turns the feature off, and the module keeps every setup. A fresh install from the Krayin CRM Starter Pack can start with it on.

• Enable 2FA turns the whole feature on or off for the admin panel.
• Require 2FA for all staff removes the skip link and makes enrolment mandatory.
• Allow staff to manage their own 2FA lets users reissue their recovery codes.
• Save Configuration applies the change and confirms with a success message.
• The Google2FA sidebar menu appears only while the feature is enabled.

The Set Up Two Factor Authentication screen opens once Krayin CRM accepts the password. Nobody hunts for a separate settings page.

The screen offers two enrolment paths side by side, so a phone camera that will not focus never turns into a dead end for the user.

• Scan the QR code with Google Authenticator, Microsoft Authenticator, Authy or 1Password.
• Use the Cannot scan the code? setup key to add the account by hand.
• Enter one six-digit code in the Authentication Code field to prove the pairing works.
• Click Verify & Enable to activate the second factor on the account.
• Choose Skip for now when enforcement is off and enrol later instead.

Recovery Codes give a user a way back into an account whose phone is lost or wiped. The module issues eight when enrolment finishes.

The screen says plainly that these codes appear only once. A user can replace the set later, but nobody can read the old one back out of Krayin CRM.

• The module generates eight single-use codes and lists them on one screen.
• Copy all puts the full set on the clipboard for a password manager.
• Download as .txt saves the set as a file before the user leaves the screen.
• Each code signs a user in once, then retires itself.
• The module ignores spacing and letter case when a user types a code.

Two Factor Verification at Sign In is the screen an enrolled user meets after the password step. It asks for the code the app shows now.

On-screen text names the supported apps, so a new staff member knows where the digits come from and which app to open first.

• Type the six-digit code into the Authentication Code field and click Verify.
• Pick Use a recovery code instead when the authenticator app is out of reach.
• The module refuses a wrong code and rejects one that has already expired.
• A code the user has just spent cannot work twice in the same time window.
• Back to sign in returns to the login form without finishing the attempt.

My Account carries a Two Factor Authentication panel. It reports whether protection runs, when it started, and how many codes remain.

The Reissue recovery codes section sits on the same page. Installs using Krayin Inventory Transfer Extension can point warehouse staff here.

• An Enabled badge marks an account that has finished enrolment.
• The panel names the enrolment date and time for the account.
• A running count warns when unused recovery codes are running low.
• Reissue Codes needs the current password plus a valid second factor.
• Reissuing retires the previous set instantly.

Changing an admin password is a common step in an account takeover. Krayin CRM 2FA guards that action with the same second factor.

The module gates only the password change. A user editing a name or uploading an avatar saves the form with no code request at all.

• Change Password asks for Current Password, Password and Confirm Password.
• An enrolled user also fills the Authentication Code or Recovery Code field.
• Save Account stores the new password only after the second factor passes.
• Everyday profile edits save without any code request.
• Forgot Password and Password Reset keep their stock Krayin CRM behaviour.

The Google2FA Admin Status Grid answers one question: who is protected right now. It lists every CRM user in a read-only table.

Search, Filter and Per Page sit above the table. Teams adding channels such as Krayin CRM WhatsApp Integration keep the list auditable.

• User shows the staff member name with their avatar.
• Email identifies the account the row belongs to.
• 2FA Status reads Active or Inactive for each user.
• Last 2FA Login carries the date and time of the last verified sign-in.
• A Krayin role permission decides who may open the grid at all.