Skip to main content

Setting Up Two-Factor Authentication

Two-factor authentication (MFA) adds a second check when you sign in to Praxi. The best way to do this is a passkey. An authenticator app and single-use recovery codes are there as fallbacks.

Why MFA Matters in Healthcare​

Praxi holds sensitive client information protected under the Australian Privacy Act 1988. MFA greatly reduces the risk of someone getting into client records, even if they learn your password.

info

Practice owners can require MFA for all staff. If your practice requires it, Praxi asks you to set it up the next time you sign in.

Your Sign-In Methods​

MethodRole
PasskeyRecommended
Authenticator appFallback
Recovery codesLast resort

A passkey uses Face ID, Touch ID, Windows Hello or a security key. Praxi always asks your device to check it's you (your face, fingerprint or device PIN). Because of that check, a passkey counts as full two-factor authentication on its own. It also can't be phished: it only works on Praxi.

An authenticator app gives you a six-digit code that changes every 30 seconds.

Recovery codes are single-use codes for when you can't use your other methods. Some screens call them backup codes.

Every step happens inside Praxi. You never sign in on another company's page.

When Praxi first asks you to secure your account:

  1. Choose Create a passkey.
  2. Follow your device's prompt (Face ID, Touch ID, Windows Hello or a security key).
  3. Save the recovery codes Praxi shows you.

To add a passkey later:

  1. Go to Settings > Security.
  2. Under Passkeys, click Add a passkey.
  3. Confirm it's you when asked, then follow your device's prompt.

Add a passkey on each device you use, or use a password manager that syncs passkeys between your devices. For full steps on web and iPhone, see Passkeys.

Setting Up an Authenticator App (Fallback)​

You can use an authenticator app instead of a passkey, or as well as one. Supported apps include:

  • Google Authenticator (iOS / Android)
  • Authy (iOS / Android / Desktop)
  • Microsoft Authenticator (iOS / Android)
  • 1Password or another password manager that supports TOTP codes

Steps​

  1. When Praxi asks you to secure your account, choose Use an authenticator app. Or go to Settings > Security and set up an authenticator.
  2. Open your authenticator app and tap Add account or the + button.
  3. Scan the QR code Praxi shows you.
  4. Enter the current six-digit code into Praxi.
  5. Save the recovery codes Praxi shows you.
tip

If you can't scan the QR code, choose Can't scan? Copy manual entry key and type that key into your app.

Recovery Codes​

Praxi gives you 10 single-use recovery codes when you set up your first method, whether that's a passkey or an authenticator app.

  • Download or print your codes straight away.
  • Keep them somewhere safe and separate from your devices, such as a locked drawer or a password manager.
  • Each code works once.
  • You can create a new set from Settings > Security at any time. This cancels all your old codes.

Praxi emails you whenever one of your recovery codes is used. If you didn't use it, tell your practice owner straight away.

Signing In​

With a passkey:

  1. On the sign-in page, click Continue with a passkey.
  2. Choose your passkey and confirm it's you on your device.

You don't need to type your email or password.

With your password:

  1. Enter your email and password.
  2. When asked, use your passkey or enter the six-digit code from your authenticator app.
  3. If you can't use either, choose Use a backup code instead and enter one of your recovery codes.

Managing Trusted Devices​

To reduce prompts on a device you use often, you can trust it when you sign in:

  1. After your second step, select Remember this device for 30 days.
  2. Praxi won't ask for your second step on that device for the period your practice has set (7 days by default, up to 30).

You can review and remove trusted devices from Settings > Security > Trusted Devices.

Adding and Removing Methods​

  • Praxi asks you to confirm it's you before you add or remove a passkey or an authenticator app.
  • Praxi emails you when a passkey is added to or removed from your account.
  • If your practice requires MFA, you can't remove your last sign-in method. Add another one first.

If You Lose a Device​

Sign in with another passkey, your authenticator code or a recovery code. Then add a new passkey and remove the lost one. See Lost Passkey or Device.

If you have no method left, ask your practice owner to reset your two-step sign-in. This signs you out everywhere. You set it up again the next time you sign in.

Practice-Wide MFA Policy​

Practice owners and administrators can require MFA across the practice:

  1. Go to Settings > Security Policy.
  2. Turn on Require MFA for all users.
  3. Staff who haven't set up MFA will be asked to on their next sign-in.

We recommend this for every practice that handles health information. Some regulatory frameworks require it.

Was this page helpful?