DealRadar uses TOTP (time-based one-time password) for second-factor authentication on privileged actions. Any standard authenticator app works — 1Password, Authy, Google Authenticator, Microsoft Authenticator, Bitwarden.
MFA is enforced on the actions that change the shape of your workspace or remove data. Specifically:
Day-to-day actions — scoring deals, importing CRM data, viewing dashboards, exporting data — do not require MFA. The gate is only on actions that touch workspace identity or membership.
Open Settings → Account
Sign in to app.trydealradar.com and click Settings in the sidebar, then the Account tab.
Click "Set up MFA"
A QR code appears alongside a 6-digit verification field.
Scan with your authenticator app
In your authenticator app, choose Add account → Scan QR code and point your camera at the QR. The app will start generating 6-digit codes that rotate every 30 seconds.
Enter the current code
Type the 6-digit code into DealRadar and click Verify. Once verified, MFA is active and admin actions will accept this authenticator.
When you trigger an MFA-gated action — say, changing a teammate from Rep to Manager — DealRadar will prompt for a fresh 6-digit code before completing the change. If you dismiss the prompt or enter an invalid code, the change is rejected with anMFA_REQUIREDerror and the workspace is left unchanged.
The verification window aligns with your authenticator app's 30-second rotation. If the code times out while you're typing, just enter the next one.
If you change phones or want to switch authenticator apps:
Removing MFA on its own does not disable the requirement for admin actions — it just de-enrolls your device. You'll need to re-enroll before you can perform another MFA-gated action.
Lost your phone or your authenticator app entries? You can still sign in normally and use every non-admin feature — only the privileged actions are gated. To get a new authenticator enrolled, email support@trydealradar.com from the address on the account. We'll verify ownership and reset MFA so you can re-enroll a new device.
For accounts on Enterprise plans with a designated security contact, the reset is handled per the procedure documented in your DPA.
SMS-based codes are vulnerable to SIM-swap attacks and carrier interception. TOTP codes never leave your device and stay valid for only 30 seconds, which keeps the factor on the same device the attacker would need physical access to. For more detail on our broader security posture, see the Security page.
Stuck on enrollment or seeing unexpected MFA prompts? Email support@trydealradar.com and we'll help you get sorted.