Two-factor authentication¶

Two-factor authentication adds a second step to password sign-in. After you enter your password, InstantFeedback asks for a six-digit code from an authenticator app on your phone or computer. Someone who learns your password still cannot sign in without your device.

• Codes come from any authenticator app that generates time-based one-time passwords, for example Google Authenticator, Microsoft Authenticator, Authy, or 1Password.
• Ten recovery codes let you sign in if you lose access to the authenticator app.
• Account admins can require two-factor authentication for every member of the account.
• Passkeys sign you in without a password and without a code, and work alongside two-factor authentication.

Before you start¶

• Install an authenticator app on your phone or computer and keep the device at hand.
• Check that the device's clock is set automatically. Codes are time-based, and a clock that is off by more than a minute produces codes InstantFeedback rejects.
• Two-factor authentication belongs to your user, not to an account. Once it is on, it applies to every InstantFeedback account you sign in to.

Enable two-factor authentication¶

1. Open User settings from the menu in the top-right corner and select the Security tab.
2. In the Two factor authentication card, click Enable.

1. In your authenticator app, add a new account and scan the QR code. If you cannot scan, click Click to reveal secret key and type the key into the app by hand.
2. Click Continue.

1. Enter the six-digit code the app shows. The dialog submits as soon as the sixth digit is typed.

1. Save the recovery codes. Click Download to save them as a text file, or copy them to a password manager. Then click Finish.

The Security tab now shows Enabled, the number of recovery codes left, and the Regenerate, Disable, and Change authenticator actions.

Sign in with a code¶

1. Enter your username and password on the login page as usual.
2. On the Two factor authentication page, enter the current code from your authenticator app. The page submits as soon as six digits are typed and shows Verification successful.
3. Click Continue, or wait a moment and you are taken into the app automatically.

There is no option to remember a device. The code is asked for at every password sign-in. Signing in with a passkey skips this step.

Use a recovery code¶

If you do not have your authenticator app:

1. On the code page, click Use a recovery code.
2. Enter one of your saved recovery codes and click Verify. Spaces and dashes in the code are ignored.

Each recovery code works once. After you sign in, a warning shows how many codes are left.

When you are running low, click Regenerate on the Security tab to get a fresh set of ten. If you have lost both the authenticator app and the recovery codes, ask an admin of your account to reset your authenticator.

Regenerate recovery codes¶

1. Open User settings → Security and click Regenerate next to Recovery codes.
2. Confirm with Regenerate. A new set of ten codes is shown; save them as before.

Change authenticator¶

Use this when you move to a new phone or a different authenticator app.

1. Open User settings → Security and click Change authenticator.
2. Scan the new QR code with the new app and click Continue.
3. Enter the code from the new app.
4. Save the new recovery codes and click Finish.

Disable two-factor authentication¶

1. Open User settings → Security and click Disable.
2. Confirm with Disable. You sign in with your password only from now on, and the recovery codes stop working. Passkeys are not affected.

The Disable button is not shown when the account you are working in requires two-factor authentication. If you belong to other accounts that require it, the dialog lists them: you lose access to those accounts until you set two-factor authentication up again.

Require two-factor authentication for an account¶

Account admins can make two-factor authentication mandatory for everyone in the account.

1. Open Settings → Account and select the Security tab.
2. Switch Required on and click Save.

Once the setting is on:

• Members who already use two-factor authentication notice nothing, except that the Disable button disappears from their Security tab and an info notice explains why.
• Members who have not set it up are taken to the setup page when they next sign in, and cannot use the account until setup is complete. There is no grace period.
• The requirement is per account. A member who also belongs to an account without the requirement can still work there without two-factor authentication.

The steps on this page are the same as in Enable two-factor authentication: scan the code, verify with a six-digit code, and save the recovery codes. Finish then continues into the app.

Reset a member's authenticator¶

When a member has lost both their authenticator app and their recovery codes, an account admin can reset their authenticator.

1. Open Settings → Users and click the member's username.
2. Select the Security tab. It shows whether two-factor authentication is enabled and lists the member's passkeys.
3. Click Reset authenticator and confirm with Reset.

After the reset, the member signs in with their password only. If the account requires two-factor authentication, they are taken to the setup page at their next sign-in.

Troubleshooting¶