Workable natively supports two-factor authentication (2FA) for password-based sign-in using a one-time passcode (OTP) sent to your email. After you verify your sign-in with an OTP, your browser and device remain trusted for 30 days, so you won't need to enter an OTP each time you sign in from that trusted browser and device.
For details on this step, see Logging in with your password and resetting it.
Note: This built-in 2FA step applies only when you sign in with a password, it's automatic and can't be turned off. If you sign in with your Google, Microsoft, or LinkedIn account instead, this OTP step doesn't apply, since verification is handled by that provider.
Trusted devices and sessions
Trusted-device sign-in is enabled for all customers and applies to anyone signing in to Workable with a password, including users of Recruiting and HR features, regardless of their role or permissions.
Workable requests an OTP again when you use a new browser or device, clear your browser cookies, or your session expires. Resetting your password does not remove your browser or device's trusted status.
The trusted-device period is fixed at 30 days. Admins cannot change this period or configure the OTP and trusted-device behavior.
A sign-in session expires after 30 days of inactivity. This is separate from the 30-day trusted-device period.
Managing access
Administrators cannot currently view or revoke trusted devices or manage users' active sessions, including signing a user out of all sessions. If you need to invalidate trusted devices or terminate active sessions, contact Workable Support. These requests can be handled on a per-request basis.
Deactivating a member removes their access to Workable, including access from previously trusted devices.
MFA options
Workable doesn't natively support broader multi-factor authentication (MFA) options, such as authenticator apps or hardware security keys. For that level of control, we offer Single Sign-On (SSO) integration with third-party providers. Using an SSO provider that offers MFA (which many do) lets you add this authentication option through their system.
Here are some guides on how to enable MFA in: