Two-factor authentication

Two-factor authentication protects your account with a second step: after your password, the system asks for a 6-digit code from an authenticator app on your phone, such as Google Authenticator or Microsoft Authenticator. Even if someone learns your password, they cannot sign in without your phone.

You set it up yourself from My profile, in the Two-factor authentication section. To open your profile, click your name at the bottom of the side menu, then My profile.

What’s on this screen

The section shows the current status: Off, Setting up or On.

• While it is off: a short explanation and Set up two-factor.
• While setting up: 1. Scan the QR code, Or enter the key (with a copy button), 2. Enter the code, then Cancel and Confirm and turn on.
• While it is on: On since, Recovery codes left, New recovery codes and Turn off.

How to turn on two-factor authentication

1. In Two-factor authentication, click Set up two-factor.
2. Open your authenticator app and add an account by scanning the QR code. If you cannot scan it, type the key shown under Or enter the key (time-based).
3. In 2. Enter the code, type the 6-digit code the app shows, then click Confirm and turn on.
4. The Recovery codes appear. Click Download or copy them, and keep them in a safe place. Each code signs you in once if you lose your phone, and they are shown only now.

How to sign in with two-factor authentication

1. Sign in with your e-mail and password as usual.
2. The Two-factor authentication page asks for the Verification code. Type the 6-digit code from the app and click Verify and sign in.
3. If you lost your phone, click Lost your phone? Use a recovery code, type one of your recovery codes in Recovery code, then click Verify and sign in. To go back to the app code, click Use a code from the app.

You have 5 minutes after the password step to enter the code; after that, the system asks you to sign in again (The sign-in took too long. Sign in again.).

Recovery codes and turning it off

• New recovery codes: creates a new set after you confirm with your password. The old codes stop working.
• Turn off: turns two-factor authentication off after you confirm with your password. Your account is then protected by the password only.

Caution

If the administrator requires two-factor authentication (Settings › Security), a user who has not set it up is sent to their profile with the message Your organisation requires two-factor authentication. Set it up to continue using the system. and cannot use other screens until it is on. In that case it cannot be turned off.

Tip

If you lost your phone and your recovery codes, ask an administrator to click Reset two-factor next to your name in Users. You can then sign in with your password and set it up again.

Required permission

None: every user can manage their own two-factor authentication. Resetting it for another user needs Users › Edit.