Multi-factor authentication (MFA) strengthens account security by requiring more than one way to verify your identity. For your Clio account, this means logging in with your username and password and then completing a second verification step—by approving a push notification on the Clio for Law Firms and Lawyers mobile app, entering a time-sensitive code sent to your mobile device via text message (SMS), or entering a code generated by an authentication app or password manager. Enabling MFA adds an extra layer of security if your password is compromised.
Set up MFA via an authenticator app
Clio currently supports authentication through password managers (i.e., 1Password) or a standard authenticator app. We recommend using a password manager that can be installed on your work computer (desktop or browser extension). This allows you to generate a time-based one-time password (TOTP) required for login without needing to access a personal mobile device for every sign-in. Enabling MFA with an app or password manager generates a TOTP on your device or in your browser. This code is required to complete your login.
What is a TOTP? A time-based one-time password (TOTP) is a temporary code generated by an algorithm. For your Clio account, this means a six-digit code that appears in your authentication app or password manager for 30 seconds before it is replaced with a new six-digit code.
Step 1: Download an authentication app
Before enabling MFA in your Clio account, download an authentication app or password manager on your smartphone or computer. Clio supports standard TOTP applications. Using a password manager lets you store and manage passwords and one-time passcodes in a single, secure location on your firm-managed devices.
Clio supports several applications, including the following:
- Google Authenticator
- 1Password
- LastPass
- Microsoft Authenticator
- Duo Mobile
- OneLogin
Step 2: Turn on MFA via authenticator app in Clio
After downloading an authentication app, you can enable MFA in your Clio Manage or Clio Grow settings. When MFA is enabled in one account, either Clio Manage or Grow, it is automatically enabled in the other account.
- Go to Settings > Security & Compliance.
- Under My Security, click Update your security settings.
- Scroll down to Multi-factor authentication and click Set up multi-factor authentication.
- Enter your Clio login password and click Continue.
- Select Authenticator app from the list of options and click Continue.
- Open your authentication app and add a new account by clicking the + icon or by clicking add account.
- Use your device’s camera to scan the QR code that appears in Clio. You can also manually enter the secret key.
- If the QR code is not visible, you may already have MFA set up on another device.
- In Clio, click Continue, enter the six-digit code generated by your authenticator, and then click Continue again.
- Click Done.
- Make sure to download a copy of your emergency backup codes.
Tip: When prompted to enter the TOTP code at your next login, check the box for Keep me logged in for a week to extend your session by a week.
- Go to Settings > Personal.
- In the Security section, click Manage my security.
- Scroll down to Multi-factor authentication and click Set up multi-factor authentication.
- Enter your Clio login password and click Continue.
- Select Authenticator app from the list of options and click Continue.
- Open your authentication app and add a new account by clicking the + icon or by clicking add account.
- Use your device’s camera to scan the QR code that appears in Clio. You can also manually enter the secret key.
- If the QR code is not visible, you may already have MFA set up on another device.
- In Clio, click Continue, enter the six-digit code generated by your authenticator, and then click Continue again.
- Click Done.
- Make sure to download a copy of your emergency backup codes.
Tip: When prompted to enter the TOTP code at your next login, check the box for Keep me logged in for a week to extend your session by a week.
Set up MFA via text messaging
Clio supports authentication via text messaging (SMS). Enabling MFA using text messaging requires a phone that can receive SMS text messages, your Clio username and password, and a temporary code sent to your phone from Clio.
You can enable MFA in your Clio Manage or Clio Grow settings. When MFA is enabled in one account, it is automatically enabled in the other.
Note: The code sent to your mobile device will expire 10 minutes after being sent.
- Go to Settings > Security and Compliance.
- Under My Security, click Update your security settings.
- Scroll down to Multi-factor authentication and click Set up multi-factor authentication.
- Enter your Clio login password and click Continue.
- Select Text message from the list of options and click Continue.
- Enter your primary phone number into the provided field and click Continue.
- The field should automatically select your country and format your phone number.
- Enter the six-digit code sent to the mobile device connected to the provided phone number, and then click Continue.
- Click Done.
- Make sure to download a copy of your emergency backup codes.
Tip: When prompted to enter the code at your next login, check the box to Keep me logged in for a week to extend your session by a week.
- Go to Settings > Personal.
- In the Security section, click Manage my security.
- Scroll down to Multi-factor authentication and click Set up multi-factor authentication.
- Enter your Clio login password and click Continue.
- Select Text message from the list of options and click Continue.
- Enter your primary phone number into the provided field and click Continue.
- The field should automatically select your country and format your phone number.
- Enter the six-digit code sent to the mobile device connected to the provided phone number, and then click Continue.
- Click Done.
- Make sure to download a copy of your emergency backup codes.
Tip: When prompted to enter the code at your next login, check the box to Keep me logged in for a week to extend your session by a week.
Use the Clio for Law Firms and Lawyers Mobile App for MFA verification
If you already have the Clio for Law Firms and Lawyers Mobile App installed and push notifications enabled on your device, push notification approval is sent to your phone by default when you log in to Clio Manage on the web. No additional setup is required.
When you log in on the web, you will receive a push notification on your phone asking if you just signed in to Clio from your web browser. Tap to approve, and your web session is authenticated.
If you used the Clio for Law Firms and Lawyers mobile app prior to setting up MFA, make sure that your notifications are turned on to receive push notifications as an MFA authentication method.
Download and use backup codes
Emergency backup codes can help you gain access to your account in case you lose your phone or lose access to your authentication app, and if you cannot sign in to Clio. See the steps below to learn how to download a copy of your backup codes in both Clio Manage and Clio Grow and how to enter a backup code when logging in.
Download backup codes:
- Go to Settings > Security & Compliance.
- Under My Security, click Update your security settings.
- Scroll down to Multi-factor authentication.
- Next to Backup codes, click Download.
- Enter your Clio login password and click Continue.
- Download your backup codes and store them somewhere safe.
- Go to Settings > Personal.
- In the Security section, click Manage my security.
- Scroll down to Multi-factor authentication.
- Next to Backup codes, click Download.
- Enter your Clio login password and click Continue.
- Download your backup codes and store them somewhere safe.
Enter backup code:
- Enter your username and password.
- Under Security code, click Use backup security code.
- Do not enter the backup code in the Security code field.
- Under Emergency backup code, enter one of your backup codes and click Sign in.
Troubleshoot MFA login issues
If you do not have access to your authenticator, you may still be able to log in to Clio since MFA sessions can be extended up to a week. If you can still log in, re-add your account to your new device or alternate authentication app.
Tip: If you get a new phone, lose your device, cannot access your Clio account as described above, or do not have access to your backup codes, ask an administrator at your firm to disable MFA for your account.