How to recover your Axos workspace
Four recovery scenarios covered in one place: lost magic link, lost 2FA device, lost workspace email, revoked session.
Scenario A — Lost the magic link email
The most common case. Go to /workspace-recovery, enter your workspace email and tap "Send recovery link". A new signed link is emailed within 15 seconds. The recovery link is functionally identical to a normal magic link and expires in 30 minutes. If the email does not arrive, check spam, then verify the address on file at /account — a common mistake is remembering the personal address when the workspace was actually provisioned under a work address.
Scenario B — Lost the 2FA device
If you enabled TOTP-based 2FA and lost the phone that held the authenticator app, the eight one-time backup codes issued when 2FA was turned on are your fallback. On the next sign-in, tap "Use a backup code" under the TOTP field, enter one of the eight codes, and 2FA is temporarily bypassed for that sign-in. Immediately open /two-factor-authentication and re-enrol a fresh authenticator; the old TOTP secret is invalidated and a new set of eight backup codes is generated.
If you also lost the backup codes, contact support@axoshub.org from the workspace email with the invoice number of any past subscription. Support will disable 2FA on the workspace after a 72-hour delay during which any active session in the workspace can cancel the request. This delay is deliberate — it protects against social-engineering attacks on the 2FA reset flow.
Scenario C — Lost control of the workspace email
Because Axos is passwordless, control of the workspace email is the sole proof of identity. If the address is no longer yours (employer email revoked, personal address abandoned, mailbox provider closed), contact support from the address you would like to migrate the workspace to and include the invoice number of any past subscription plus, ideally, a screenshot of a recent magic-link email from before the address was lost. After identity verification (typically two working days), the workspace is re-bound to the new address and a fresh magic link is issued.
Scenario D — Session was revoked by mistake
Revoking a session on /session-and-devices is instant but not destructive. The revoked browser is signed out; nothing is deleted. Request a new magic link on /login, tap it in the browser you meant to keep, and you are back in. If you revoked all sessions and cannot receive the magic link (see Scenario C), follow the workspace-email-lost flow.
What Axos will never ask
Support will never ask for your magic link, your 2FA code, your backup codes or your session cookie. Anyone claiming to be Axos support and asking for those items is impersonating us — report it to dpo@axoshub.org. Legitimate identity checks rely exclusively on control of the workspace email and, for scenario C, on invoice numbers issued by our billing service.