Mersal Authenticator App
A mobile app for offline TOTP codes and push-style approve/deny sign-in, working across mersal.it and any Mersal-OTP WordPress site.
The Mersal Authenticator app is a dedicated mobile app for account security — it doesn't send marketing messages, it protects the accounts that do.
There's a download page (APK) for the app linked directly from the Mersal dashboard, so you don't need to hunt for it separately.
Two ways to authenticate
The app supports two distinct modes, and you're not limited to picking just one:
- Offline TOTP codes — the app generates a rotating 6-digit code, the same way Google Authenticator or a similar TOTP app does. Because it's time-based rather than network-based, it works with no internet connection — useful anywhere connectivity is unreliable, or as a code you can always fall back to.
- Online "approve sign-in" — a push-style flow where a login attempt shows up as a request on your phone, and you approve or deny it with a tap. No code to read or type; you just confirm it's really you.
Approve/deny requires the app to reach the network (it's a live request), while TOTP codes work offline by design. If you're somewhere without a signal, use the 6-digit code instead of waiting on a push prompt.
One app, the whole ecosystem
The Authenticator app isn't scoped to a single login screen. Once paired to your account via SSO, it works for:
- Logging into mersal.it itself — securing your Mersal dashboard account.
- Any WordPress site running the Mersal-OTP plugin — the same app, the same paired identity, protecting sign-ins on every site where that plugin is active.
That means setting the app up once covers your Mersal account and every WordPress/WooCommerce site you've connected through Mersal-OTP — you don't pair a separate authenticator per site.
Setting it up
- Download the APK from the link on your Mersal dashboard.
- Install it and pair it with your Mersal account via SSO.
- From your account's security settings, enable two-factor authentication and choose whether sign-ins should prompt for a TOTP code, an approve/deny push, or both.
- On any WordPress site running Mersal-OTP, the same paired app can be used to secure sign-ins there too.
See Installation for where this app fits among the other ecosystem pieces, and Two-Factor Authentication for the full picture of how 2FA works across your Mersal account.