Two-factor authentication

Two-factor authentication asks for a six-digit code from an authenticator app whenever you sign in with your password. It's optional for most people and required for admins and owners of an organisation with other members.

When two-factor is required#

You must use two-factor authentication if you're an admin or the owner of an organisation that has more than one member.

While the requirement applies and you haven't set it up:

• the only page Folioso opens is the two-factor setup page, which says "You administer an organisation with other members, so a second factor is required before the rest of Folioso opens.";
• your API tokens stop working until you finish setting it up;
• you can't turn two-factor off afterwards. The page says it's Required for admins and owners of an organisation with other members, so it cannot be switched off.

If you're only a member, or every organisation you administer has just you in it, two-factor is optional.

Set up two-factor#

You need an authenticator app on your phone or computer, such as any app that supports time-based one-time codes.

1. Open Settings and, under Security, select Set up two-factor.
2. Enter your Current password and select Begin setup.
3. Scan the QR code with your authenticator app. If you can't scan it, use Copy key to enter the key by hand, or Open in authenticator app on a device that has one.
4. Enter the Six-digit code your app shows and select Turn on two-factor.

Nothing changes until you enter a code. Finish within 15 minutes, in the same browser; otherwise you'll see Start the setup again — that code has expired. Select Start again with a new code, enter your password and select Start again.

Save your recovery codes#

As soon as two-factor is on, Folioso shows you 8 recovery codes. This is the only time they're shown.

• Use Copy codes or Download to keep them somewhere safe, such as a password manager.
• Each code works once, in place of an authenticator code.
• Select I have saved them when you're done.

What changes when you turn it on#

Any device you'd asked Folioso to remember is forgotten. The next time you sign in on it, you'll need your password and a code. The device you used to set up stays signed in for now.

Sign in with two-factor#

After your email and password, enter the code from your app. If you don't have your device, select Lost your device? Use a recovery code. See Signing in.

Two-factor applies to password sign-in. Signing in with GitHub or your organisation's single sign-on doesn't ask for a code, because your identity there is already the second factor.

Manage your recovery codes#

Settings shows how many unused recovery codes you have left. To get a fresh set:

1. Under Security, select Manage two-factor.
2. Enter your Current password and select Regenerate recovery codes.

Your old codes stop working, and the new ones are shown once.

Turn off two-factor#

If two-factor isn't required for you:

1. Under Security, select Manage two-factor.
2. Enter your Current password and select Turn off.

If you're an admin or owner of an organisation with other members, Turn off isn't offered.

Move to a new authenticator#

Folioso replaces an authenticator by turning two-factor off and setting it up again. You can't start a new setup while two-factor is on.

• If two-factor is optional for you, sign in (with a recovery code if you need one), select Manage two-factor, Turn off, then Set up two-factor on the new device.
• If it's required, you can't turn it off. Move the existing entry to your new device with your authenticator app's own transfer or backup feature, and keep using your recovery codes until you have. If that isn't possible, the requirement lifts while you aren't an admin or owner of an organisation with other members, so if you aren't the owner, another admin can change your role to member while you set it up again, then make you an admin again.