Two-factor authentication in the Kodo Portal
You can now add a code from an authenticator app to your Kodo Portal sign-in, giving your account an extra layer of protection beyond its password.
Two-factor authentication is now available in the Kodo Portal. Clients and partners can enable it themselves in Account security. It is optional for these accounts, and we recommend using it when working with company documents and communication.
The setup uses an authenticator app that generates a changing six-digit code. This method is called TOTP: a time-based one-time password. The portal interface calls it Two-step verification.
Why add a second step?
A password can be exposed through reuse, a misleading sign-in page or a compromised device. An authenticator adds another check: knowing the password alone is no longer enough to complete a new sign-in to an account with two-factor authentication enabled.
The UK National Cyber Security Centre recommends two-step verification for important accounts. For a business workspace, that extra check helps protect access to documents, correspondence and ongoing work.
It does not make an account immune to every attack. Keep a unique password, protect your devices and enter verification codes only on the genuine portal sign-in screen.
How to turn it on
Have your authenticator app ready. The portal names Google Authenticator, Microsoft Authenticator and 1Password as examples. The instructions below use the English interface labels.
- Sign in to your account. Open the Kodo client area and continue to sign in.
- Open Account security. In the client workspace, the link appears near your account details at the bottom of the desktop sidebar, or in the navigation menu on mobile. Partners can find it in their portal navigation.
- Add an authenticator. You can enter a descriptive Device name, such as “Work phone”, then select Add authenticator. The name helps you identify the authenticator later.
- Scan the QR code. Add the displayed QR code to your authenticator app. Keep this setup screen private; do not send its QR code to another person.
- Confirm the first code. Enter the app’s current code in Six-digit code, then select Verify and continue.
- Check the result. After successful verification, Account security shows Two-step verification is enabled. Your verified authenticator also appears in the list.
Scanning the QR code alone does not complete setup. The first code must be verified. If you decide to stop before completing this step, use Cancel setup.
Once enabled, a new sign-in requires the authenticator check before you can continue to protected portal content. Enter the current six-digit code when prompted and select Verify and continue. You do not need to repeat setup each time, and an already verified session can continue without asking for a code on every page.
Prepare a backup before you need it
Account security supports more than one authenticator. Add a second independent authenticator and verify its first code using the same process. Choose an arrangement you can still access if your usual device is lost; two apps on the same phone do not protect against losing that phone.
If several authenticators are registered, the verification screen lets you choose which one to use. Give them clear device names so you can recognise them.
If you lose access to your usual authenticator, use another one you have already enrolled. If all are lost, contact Kodo for verified account recovery. Resetting your password does not remove two-factor protection.
Optional for clients and partners, required for administrators after setup
For client and partner accounts, enabling two-factor authentication is your choice. You can manage enrolled authenticators in Account security. Removing one requires a fresh verification code from that authenticator.
Kodo administrator accounts have a different policy: once the first authenticator has been verified and setup is complete, two-factor authentication becomes mandatory. The portal does not allow an administrator to remove the last verified authenticator.
An account activation email is a separate step. It confirms your email address and helps you set up access; it does not enable the recurring authenticator check described here.
A shared place for documents and ongoing work
The Kodo Portal brings the practical parts of working with Kodo into one workspace. Depending on the services activated for your company, you can:
- Keep supporting documents and files with the relevant work.
- Continue communication and respond to requests for missing information.
- Follow the status of enquiries, cases and agreed tasks.
That can help when several documents or follow-up questions belong to the same assignment. The available areas depend on your company’s access and agreed services.
If you already use the portal, open Account security and complete the authenticator setup. If you are new to Kodo, you can request a portal account. Registration is reviewed before access is activated; creating an account does not by itself start paid work.
Frequently asked questions
Do clients and partners have to enable two-factor authentication?
It is optional for client and partner accounts. We recommend enabling it. Kodo administrators have a separate policy: verification becomes mandatory once their initial authenticator setup is complete.
Which authenticator app can I use?
The setup uses TOTP codes from an authenticator app. The portal names Google Authenticator, Microsoft Authenticator and 1Password as examples. Scan the setup QR code and verify the first six-digit code to finish enrolling it.
Does clicking the activation email turn on two-factor authentication?
No. Email confirmation and account activation are separate from two-factor authentication. To enable the authenticator check, open Account security, add an authenticator and verify its first code.
What happens if I lose my phone?
Use another authenticator you previously added and verified. If you cannot access any enrolled authenticator, contact Kodo for verified account recovery. A password reset does not remove the second-factor requirement.
Can I remove an authenticator?
Yes, through Account security using Remove authenticator and a fresh code from the authenticator being removed. Clients and partners can disable their optional protection by removing the last authenticator after verification. Administrators must retain at least one verified authenticator.
How Kodo can help
If you need help finding Account security or understanding the setup, contact Kodo. Keep your QR code and verification codes private; do not include them in your message.
Open the Kodo client area to sign in and add an authenticator to your account.
Related reading
- Kodo Portal: Czech EPR, business enquiries and an app you can install
- A shared Czech EPR workspace for international partners
- Find text inside PDFs and images in the Kodo Portal
Sources
Portal instructions checked against the current Kodo implementation on 21 October 2026. Interface labels refer to the English version.