Two-factor authentication adds a second step to signing in: after your password, you enter a 6-digit code from an authenticator app on your phone. Someone who learns your password still can't get in without your phone.
You manage it from Settings → Security.
Turning on two-factor for your login
You'll need an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator, Authy or 1Password.
- Go to Settings → Security and click Turn on.
- Scan the QR code with your authenticator app. If you can't scan it, type the key shown under it into the app instead.
- Enter the 6-digit code your app shows, then click Verify and turn on.
From then on, after your password you'll be asked for the current code from your app. Codes change every 30 seconds; if one doesn't work, wait for the next.
To turn it off, click Turn off on the same page. You can't turn it off if your club requires it.
Requiring two-factor for the whole team
Owners can make two-factor compulsory for everyone on the team.
- Turn on two-factor for your own login first.
- On Settings → Security, switch on Require two-factor for everyone.
Nobody is locked out. Anyone without two-factor is taken to the Security page the next time they open the dashboard, and sets it up there before carrying on. The page lists who hasn't set it up yet. Owners and admins can also see who has it on, with the 2FA badge on the Team page.
If someone loses their phone
There are no backup codes. Instead, someone on the team resets it:
- Anyone who can manage the team (admins, by default) clicks Reset 2FA next to the person on the Team page. Only an owner can reset another owner.
- Their authenticator is removed and they're signed out everywhere. They sign in with their password and set two-factor up again on their new phone.
If you're the only owner and you've lost your phone, contact PocketPass support. We'll confirm who you are and reset it for you.
Signing out of other devices
Signed in on a shared or lost computer? On Settings → Security, click Sign out next to Other devices. You stay signed in where you are.
To change your password, go to Settings → Account.
Everything is logged
Turning two-factor on or off, resets, the team requirement, sign-ins and wrong codes all appear in the audit log.