Two-factor sign-in

Applies to Workletto 1.x.

With two-factor sign-in, signing in takes your password and then a 6-digit code from an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator, 1Password or Authy. Someone who learns your password still can’t sign in without your phone.

People who sign in through single sign-on aren’t asked for a code. Two-factor sign-in for them is set up with your single sign-on provider.

Click the picture to zoom in.Close

Set it up

1. Open the menu with your name at the bottom of the sidebar and choose Two-factor sign-in.
2. Enter Your password and click Set up two-factor sign-in.
3. In your authenticator app, add an account and scan the QR code. If you can’t scan it, type the key shown under it instead.
4. Enter the 6-digit code the app shows under Code and click Turn on. If the code is wrong, Workletto says “That code didn’t work. Enter the code your app shows now.”
5. Workletto shows 10 backup codes. Save them somewhere safe, like your password manager; Copy the codes copies them all. Each one signs you in once without your phone, and they aren’t shown again. Click I’ve saved my backup codes.

The account in your app is named after your organization’s app name.

Sign in

After your email and password, Workletto asks for the 6-digit code from your authenticator app. Enter it and click Sign in.

Without your phone, click Use a backup code instead and enter one of your backup codes. Each backup code works once.

Codes count toward the same limit as passwords: after 10 failed tries in a minute from one address, that address waits a minute. After 5 wrong codes in one sign-in, Workletto says “This sign-in has ended. Sign in again with your password.”, and repeated wrong codes lock the account for a while. There’s no “trust this device”: every sign-in with a password asks for a code.

New backup codes, or turning it off

Open Two-factor sign-in from the menu with your name again.

• Get new backup codes: enter your password and click Make new codes. The new codes replace all the old ones.
• Turn off two-factor sign-in: enter your password and the current code from your app (or a backup code), and click Turn off.

Require it for everyone (admins)

Under Manage, Settings, Two-factor sign-in, tick Require two-factor for everyone. The section also says how many people use it. Set up your own first: until you have, Workletto says “Set up two-factor sign-in for yourself first, from the menu with your name.”

Once it’s required, anyone who signs in with a password and hasn’t set it up sees Set up two-factor sign-in straight after signing in, and can’t use the rest of the app until they have (or they can sign out). People who sign in through single sign-on aren’t asked. Turning the requirement on or off is recorded in the History.

Someone lost their phone (admins)

Under Manage, People, open More actions beside the person and choose Reset two-factor. It appears only for people who use two-factor sign-in. Workletto asks to confirm. They then sign in with their password alone and set two-factor up again; if your organization requires it, they’re asked to straight away. The reset is recorded in the History.

What’s kept

The key your authenticator app uses is stored encrypted, and backup codes are stored only in a scrambled form that can’t be turned back into the codes. If you restore a backup into a new copy of the app that has a different BETTER_AUTH_SECRET, two-factor sign-in is turned off for everyone in it so nobody is locked out, and each person sets it up again.