Two-factor authentication

Two-factor authentication (TFA) adds a second step to signing in: after your password, you enter a 6-digit code from an app on your phone. Even if someone learns your password, they can’t sign in without your phone. It’s optional, and you set it up yourself.

Before You Start

Install an authenticator app on your phone, such as Microsoft Authenticator, Google Authenticator, Twilio Authy or FreeOTP. All are free from your phone’s app store. The setup page also lists them.

Set Up the App

1. On any admin page, point to your name at the top right and choose View profile, then select the TFA tab.
2. Under TFA application, select Set up application.
3. Enter your current password and select Confirm.
4. In the authenticator app, add an account and scan the QR code. If you can’t scan it, type the setup code shown above the QR code into the app instead.
5. The app now shows a 6-digit code for your website that changes every 30 seconds. Enter the current code in Application verification code.
6. Select Verify and save. “TFA setup complete” appears, and the TFA tab shows Status: TFA enabled.

Make Recovery Codes

Recovery codes let you sign in when you don’t have your phone. Make them right after setting up the app.

1. On the TFA tab, under Recovery Codes, select Generate codes.
2. Enter your current password and select Confirm.
3. Copy or print the 10 codes and keep them somewhere safe, away from your phone, such as a password manager.
4. Select Save codes to account. The codes don’t work until you do.

Each code works once. To see your codes again, select Show codes on the TFA tab. To replace them all with new ones, select Reset codes.

Sign In With a Code

1. Sign in with your username and password as usual (see Signing In).
2. On the Two-Factor Authentication page, open the authenticator app and enter the current 6-digit code.
3. Select Verify.

You’re asked for a code every time you sign in, including after resetting your password.

Sign In Without Your Phone

On the Two-Factor Authentication page, select TFA Recovery Code, enter one of your recovery codes (for example 123 456 789) and select Verify. That code can’t be used again.

New Phone?

Sign in with a code from your old phone or a recovery code, open the TFA tab and select Reset application. Enter your current password, then scan the new QR code with the app on your new phone and enter its code, as under Set Up the App. Codes from the old phone stop working.

Tips

• If a code is refused, wait for the next one and enter it quickly. Codes depend on the time, so check that your phone’s clock is set automatically.
• You can’t switch two-factor authentication off yourself. If you’ve lost your phone and your recovery codes, contact VC3 support to reset it.