Skip to content
Connect an agent

Hosted diagrams and plans

Two-step sign-in

Two-step sign-in asks for a code from an authenticator app on your phone after the emailed code, so someone who gets into your email still cannot sign in as you. It is also called 2FA or MFA. An organisation can require it of every member.

TL;DR

QuestionAnswer
Where do I turn it on?In the portal, under Security in the sidebar, then Set up two-step sign-in.
Which apps work?Any app that makes six-digit codes from a QR code: 1Password, Google Authenticator, Microsoft Authenticator, Authy, Bitwarden and others.
What if I lose my phone?Sign in with one of the ten recovery codes you saved when you turned it on. Each one works once. Make new ones on the Security page at any time.
What changes when I sign in?After the emailed code, the page asks for the code your app shows now, or a recovery code.
What happens to my other sessions?Turning it on signs you out everywhere else, so no browser opened before carries on without the second step.
Can my organisation require it?Yes. The owner or an admin turns on Require two-step sign-in in the organisation's Security tab. Every plan with organisations has it.
Can I remind members who do not have it?Yes. The owner or an admin can email them a reminder from the organisation's Security tab, each member at most once a day. See Reminders to turn on two-step sign-in.
What does a member without it see?A page that says the organisation requires it, why, and the steps to set it up. Nobody is removed, and the organisation opens again the moment it is on.
What about single sign-on?A sign-in through your organisation's identity provider meets the requirement, because the provider asks for its own second factor.
Can I turn it off?Yes, with a code or a recovery code, unless an organisation you are in requires it.
Is it recorded?Yes. Turning it on or off, making new recovery codes and signing in with a recovery code are recorded in your account's history, and an organisation's change of the rule in its audit log.

Turn it on

  1. Open Security in the portal's sidebar and press Set up two-step sign-in.
  2. Get an app. Install an authenticator app, or use one you already have.
  3. Scan. In the app, add an account and scan the QR code. If you cannot scan, copy the key under it into the app instead.
  4. Verify. Enter the six-digit code the app shows now. It changes every 30 seconds.
  5. Save codes. Copy or download your ten recovery codes and keep them somewhere safe, such as a password manager. They are shown only once. Tick I saved my recovery codes and press Done.

Sign in

  1. Enter your email and the code we send you, as before.
  2. Enter the code your authenticator app shows for Plotwork.
  3. No phone? Choose Use a recovery code instead and type one of your saved codes.

A sign-in waits ten minutes for the second code and takes five wrong ones. After that, start again with a new emailed code.

Require it for an organisation

  1. Open the organisation, then Security in its sidebar.
  2. Turn on Require two-step sign-in. The box says how many members do not have it yet.
  3. Under Who has it on, the owner and admins see each member without it, to follow up with.

You need two-step sign-in on your own account before you can require it, so you are not locked out. While the rule is on, a member without it cannot use the organisation through the portal, a personal key or a connected agent until they turn it on. The organisation's own keys, used by CI, are not affected.

See also

PageWhy
Single sign-onSigning members in through your identity provider
OrganisationsRoles, members and invitations
Reminders to turn on two-step sign-inEmail the members who do not have it yet
ConnectorsSend the reminders from your own domain, through your own email provider
Audit logWhere a change of the rule is recorded
Privacy policyWhat two-step sign-in stores, and for how long