Your messaging platform account holds your entire customer database and your sending numbers. If it's breached, the damage isn't only stolen data — it's the possibility of someone messaging all your customers in your name. Two-factor authentication is the cheapest insurance against that.
What exactly is at stake
People underrate the risk because they picture an abstract "data breach". The reality is more concrete:
- Your whole customer database — numbers, names and purchase history, exported in one file.
- Your credit balance — burned through on campaigns that aren't yours, within hours.
- Your WhatsApp numbers — torched by spam campaigns in your name, with the ban landing on your number.
- Your reputation — your customers receive fraud messages from a source they trust.
That last one is the most expensive, and a password change doesn't restore it.
Why a password alone isn't enough
Passwords leak from other sites, get reused, and get guessed. Two-factor adds a second factor: something you have (your phone), not just something you remember.
Your options in Mersal
- An authenticator app (TOTP): a 6-digit code that rotates every 30 seconds. The strongest option, and it works with no network.
- The Mersal Authenticator app: the same TOTP codes, plus one-tap sign-in approval instead of typing a code. It pairs with your account over SSO, and also supports WordPress sites running Mersal OTP.
Why an app beats a code by message
A code sent in a message can be intercepted through techniques like SIM swapping. An app generates the code locally on your device — nothing travels the network to be stolen.
Ranked weakest to strongest: password alone → SMS code → WhatsApp code → TOTP app → one-tap app approval. Every step up that ladder is a real gain.
Turning it on, step by step
- Open two-factor authentication in your account settings.
- Install the Mersal Authenticator app and pair it with your account.
- Scan the QR code, or confirm pairing over SSO.
- Enter the displayed code once to confirm your device clock is accurate.
- Save your recovery codes immediately — this is the step everyone postpones and later regrets.
- Sign out and back in to confirm everything works before you put the phone away.
Recovery codes
The biggest fear about two-factor is "what if I lose my phone?". That's why you save your recovery codes somewhere safe and not on the same phone. Without them you can lock yourself out.
Good places: a password manager, paper in a locked drawer, an encrypted file on another machine. Bad places: your phone's photo roll, your own WhatsApp, or a note on the same phone.
If you actually lose the phone
- Use a recovery code to sign in from another device.
- Unpair the old device from security settings immediately.
- Pair the new device and generate fresh recovery codes (the old ones are voided).
- Review the login log and any devices linked to your WhatsApp numbers.
- Rotate your API key if the phone held any account credentials.
Team accounts
If more than one person uses the account, give each of them their own sub-account instead of sharing one login. The benefits:
- You know who did what.
- When someone leaves you revoke just their access, without changing the password for everyone.
- Each person has their own second factor.
The basics people forget
- Your API key is a password — don't put it in public code or send it in a chat.
- If you suspect it leaked, rotate it immediately.
- Periodically review the devices linked to your WhatsApp numbers and disconnect anything you don't recognise.
- Don't sign in over unprotected public Wi-Fi.
- Put two-factor on your recovery email as well — the weakest link is the one that breaks.
Frequently asked questions
Will this slow down my daily login? You can mark a device as trusted so it doesn't prompt every time, and one-tap approval takes a second.
Can I enforce it on my team? Yes, and you should — one unprotected account undoes the protection on all the others.
Does the app need internet? TOTP codes work fully offline. Only one-tap approval needs a connection.
