Sign-in security: codes, trusted devices and lockout
Turn on 6-digit sign-in codes for yourself or for the whole company, understand trusted devices, and know what happens after too many wrong tries.
Sign-in codes
A sign-in code is a second step after the password: a 6-digit code sent to your WhatsApp from BMexa’s number, or by email, valid for 10 minutes. Codes are required for the BMexa platform team always, for everyone in a company whose admin switches it on, and for anyone whose role requires it; everyone else can opt in from their profile. Partners and clients signing in to the portals are not asked for codes.
Turning codes on for yourself
- Open Account › Profile and find the Sign-in codes card.
- Add your Mobile in the Details card first if you want codes on WhatsApp; without a verified mobile, codes come by email.
- Click Turn on. BMexa sends a test code to your WhatsApp; type it under Code from WhatsApp and click Confirm. The card then says Codes go to WhatsApp +91 … or Codes come by email.
- Use Verify mobile again after you change your number, and Turn off to stop (unless your company or role requires codes).
Requiring codes for the whole company
- As an admin open Settings › Company settings › Security.
- Switch on Require sign-in codes for everyone. From their next sign-in, every staff member enters a code after the password.
Signing in with a code
- After the password, Enter your sign-in code appears: “We sent a 6-digit code to WhatsApp +91 ******1234. It works for 10 minutes.”
- Trust this device for 30 days is ticked by default; the device is not asked again for 30 days.
- Send again after 30 seconds; Send the code by email instead if WhatsApp is slow. At most five codes an hour per person.
- Five wrong codes end that code; sign in again. The code is asked again on a new device, after 30 days, after a password change, or after Sign out everywhere.
Lockout and sessions
- Ten wrong passwords or codes within 15 minutes lock the account for 15 minutes (Too many wrong tries. Try again in N minutes). The person and every active admin are emailed “BMexa account locked”.
- Sign-in requests are also rate-limited: 20 a minute, and five forgot-password or forgot-username requests a minute.
- A web session lasts 24 hours, a phone session 30 days; neither is extended by use. Completing a password reset ends every session.
- On the phone, Me › Signed-in devices lists every browser and phone signed in as you, with Sign out per device and Sign out everywhere.
- An admin who gives you a temporary password forces Set your password on your next sign-in.
Updated on 29 October 2026