At Bookassist, keeping your account and your guests' data secure is always a priority. As part of our ongoing investment in platform security, the Extranet logins include an additional verification step: Multi-Factor Authentication (MFA).
You can now choose how you receive your verification code: by email, as before, or through an authenticator app on your phone or computer.
What is Multi-Factor Authentication?
Multi-Factor Authentication (MFA) is a security method that requires you to confirm your identity in two different ways before you can log in, rather than relying on a password alone.
With MFA enabled, logging into the Bookassist Extranet involves:
- Something you know — your username and password, as usual.
- Something you have — a one-time verification code, either sent to the email address assigned to your username or generated by an authenticator app you have set up.
Only someone with both your password and your inbox, or your password and your authenticator app, can complete a login. This makes it far harder for anyone else to get into your account, even if your password were ever guessed, stolen or leaked.
Tip: use a unique, valid email address for each user. Each username should have its own individual, correctly working email address assigned to it, rather than sharing one inbox across several members of staff. This ensures codes reach the right person promptly and keeps each person's access properly tied to them.
This is essential, not just good practice — even if you use an authenticator app. Email is always your back-up route if you cannot use your app. If the email address assigned to a username is invalid, mistyped or no longer working, the code cannot be delivered and that user may be unable to log in. Please make sure every user's email address is correct and active.
Why does Bookassist use MFA?
At Bookassist, protecting your account and information is a priority. We are always looking for ways to make the Bookassist extranet more secure. Multi-factor authentication (MFA) MFA adds a simple extra layer of protection to the measures already in place, helping to ensure that only authorised users can access the Extranet.
This work also supports our commitment to PCI DSS compliance — the security standard that governs how payment card data must be protected — helping us keep guest and hotel data secure to the highest industry standards, today and as new best practices emerge.
The introduction of MFA is part of our ongoing commitment to maintaining a secure and reliable extranet experience for our customers.
A few things worth knowing about how we've approached this:
- Email by default. Codes are sent by email unless you choose otherwise, so there is nothing you have to install.
- An app if you prefer it. If you would rather not wait for an email, you can set up an authenticator app in your profile. It is entirely optional.
- No sudden disruption. MFA is switched on for your account automatically the next time you are prompted to renew your password.
- Minimal day-to-day impact. The only change to your routine is entering a short code when you log in.
How MFA works for you
Every login follows the same simple pattern:
- Enter your username and password as normal.
- Get your one-time verification code — from your email, or from your authenticator app if you have set one up.
- Enter the code on the verification screen to complete your login.
The code is:
- Single-use — each code can only be used once.
- Time-limited — it expires after 5 minutes, so it's best to check your email as soon as you're prompted.
- Easy to request again — if it hasn't arrived after 5 minutes, simply select Resend code on the verification screen.
⚠️ If you do not receive the code straight away, you should try refreshing your inbox and, as a precaution, check your ‘spam’ folder as well before requesting a new code.
Using an authenticator app
An authenticator app creates your verification code on your own device, so you no longer have to wait for an email. It is optional, and you can switch back to email at any time.
Which apps can I use?
You can use any standard authenticator app. Popular options include:
- On your phone: Google Authenticator, Microsoft Authenticator, Authy, etc.
- On your computer: a desktop authenticator or browser extension.
- Your password manager: many already include an authenticator, such as 1Password, Bitwarden, Dashlane or NordPass. If your hotel already uses one, this is often the easiest choice.
You do not need a work mobile. If you would rather not use a phone, you can set everything up on your computer.
How to set up the app
Once you are logged in the Extranet, a pop-up message will be displayed letting you know that you can configure an authenticator app. Click on 'Set up now' button and follow the instructions:
⚠️ Keep your QR code and setup key private. Anyone who has them could create your codes. Never share them by email or chat, and never save them where colleagues can see them.
Logging in with the app
- Enter your username and password as normal.
- Open your authenticator app and find the Bookassist entry.
- Type in the code currently shown and complete your login.
Codes in the app change every 30 seconds. If the code is about to change, simply wait for the new one.
Receiving your code by email
If email is your method, or you choose to receive a code by email on the verification screen, the code is:
- Single-use — each code can only be used once.
- Time-limited — it expires after 5 minutes, so it's best to check your email as soon as you're prompted.
- Easy to request again — if it hasn't arrived, select Resend code on the verification screen.
The email comes from no-reply@bookassist.com with the subject Bookassist Security Verification Code.
⚠️ If the code doesn't arrive straight away, refresh your inbox and check your spam folder before requesting a new one. If this happens to you often, an authenticator app is a good alternative.
Trusted Browser
Once you have entered a verification code successfully, that browser is trusted for 30 days. During that time you log in with your username and password and go straight into the Extranet, with no code needed.
This works in the same way whichever method you use. You verify again the first time you use a new browser or device, and once every 30 days.
One IMPORTANT exception: If you have access to credit card details
Trusted Browser applies only to users who do NOT have access to credit card details.
Users with card access will continue to be asked for a verification code every time they log in, with no 30-day period.
This is not something we can choose: the card security rules we work to require that anyone who can reach card data is asked for their second factor on every single login.
When a code is still requested
- The first time on a new browser or device
- In a private or incognito window, every time
- After clearing browsing data
- Every 30 days, on each browser
- After a password change or reset
- After a change to role, permissions, account status or email address
-
At every login, if you have access to credit card details
Common issues and how to resolve them
My email address is invalid or no longer works:
Contact our Support team straight away so it can be corrected. Even if you use an authenticator app, a working email address is your back-up, so please keep it up to date.
I haven't received my verification code
Give it a few minutes and refresh your inbox — the first email can sometimes take a little longer to arrive than usual. Be sure to check your spam or junk folder too, as automated emails are occasionally filtered there by mistake.
-
Email Subject: Bookassist Security Verification Code
-
From: no-reply@bookassist.com
If it still hasn't turned up, use the Resend code option on the verification screen to trigger a new one. If delays happen regularly, consider setting up an authenticator app.
My code says it's expired
Codes are only valid for 5 minutes as a security measure. If yours has expired, simply request a new one and try again.
I entered the code but it's not being accepted
Double-check you've copied the whole code, with no extra spaces or missing digits. If you enter an incorrect code multiple times, you may be asked to wait briefly before trying again — this is a standard safeguard against repeated failed attempts.
I'm not receiving emails at all
Verification codes are always sent to the email address assigned to your username. If you've changed email addresses recently, share an inbox with other users, or you're unsure which address is on file, please contact your hotel's Bookassist administrator or our Support team so it can be checked and updated. As a reminder, each username should have its own unique, individually-checked email address for the best and most secure experience.
My account has been temporarily locked
This is separate from MFA itself: after 6 failed login attempts with an incorrect password, the Extranet locks the account for 30 minutes as a standard security precaution. Simply wait for the lock to lift, or use I forgot my password to reset it.
I wasn't expecting this extra step
If MFA appears unexpectedly during login, it simply means your account has reached its scheduled password renewal. This is expected behaviour and not a sign that anything is wrong with your account.
The code from my app isn't accepted
Check that:
- You're using the Bookassist entry in your app, not another account.
- You typed the code shown right now — codes change every 30 seconds.
- The date and time on your phone or computer are set automatically. If the clock is even a minute or two out, codes won't match.
If it still doesn't work, select 'Use a different method' to log in with your email, then set up the app again in your profile.
I can't scan the QR code
You can add Bookassist to your app manually using the setup key instead. Check 'Can't scan the QR code? Enter this setup key manually' on the set-up screen and copy the key into your app.
I've lost my phone, got a new one, or deleted the app
Log in using the email option on the verification screen, then set up the app again in your profile. See If you lose, change or reset your phone or computer above.
I don't see Bookassist in my app any more
This can happen after changing phone or restoring a back-up. Log in with the email option and set up the app again.
Frequently asked questions (FAQs)
Do I have to install an app? No. Email remains the default and works exactly as before. The authenticator app is an optional alternative for anyone who prefers it.
Why would I choose the app over email? Your code is ready instantly, with no waiting for an email and no risk of it landing in spam. It is especially handy if you have access to credit card details, as you are asked for a code at every login.
Do I need a work mobile to use the app? No. You can set it up on your computer with a desktop authenticator, browser extension or password manager.
Can I use the password manager we already have? Yes, if it includes an authenticator feature. 1Password, Bitwarden, Dashlane and NordPass are examples that do.
Does the app need an internet connection? No. Once set up, the app creates codes on your device without needing a connection.
Can I go back to email after setting up the app? Yes, at any time, in the tab '2 step verification code' in your profile.
Will resetting my password remove my authenticator app? No. Your app stays set up. After setting your new password, you log in as normal and enter a code from your app.
Can I opt out of MFA? No. MFA is a core part of how we protect Extranet accounts and guest data. You can, however, choose the method that suits you best.
Is this a one-off set-up? MFA enrolment happens once, at your next password renewal. Setting up an authenticator app is also a one-off. After that, you simply enter a code when one is requested.
Can two users share the same email address or authenticator? This isn't recommended. Each username should have its own email address and its own authenticator set-up, used only by that person. Sharing removes much of the protection MFA is designed to give.
Two of us share the front-desk computer. Can my colleague get into my account? No. The trusted 30 days belong to the person, not the computer, so your colleague still needs their own password and code. If you set up an authenticator on a shared computer, use a personal password manager account or another tool only you can open.
I use the Extranet at work and at home. Do I have to verify both? Yes, once on each. Each browser is then remembered separately for its own 30 days. The same applies to a phone or tablet.
Why does my colleague get remembered and I don't? Most likely, one of you has access to credit card details and the other doesn't. Anyone with card access is asked for a code every time.
Can my browser be remembered for longer than 30 days? No. It is the same 30 days for everyone — our balance between convenience and keeping accounts properly protected.
What if someone steals my laptop or phone? Let us know straight away and change your password. This cancels every trusted browser on every machine. If the stolen device had your authenticator app, set the app up again on a new device too.
Need more help?
If you run into any issues that aren't covered here, or if anything about the process is unclear, our Support team is on hand to help