Skip to content
TDACorpIDENTITY
Latest
Sign in

Authenticator app

Set up an authenticator app as a second factor, what to expect at each step, and how to turn it off.

On this page

An authenticator app makes a new six digit code every 30 seconds. After your first sign-in step you type the current code, which proves you hold the phone or device the app runs on. The Two-step verification tab describes it as the second proof after your password: an authenticator app, with recovery codes as the fallback.

A passkey that checks your device lock is already a strong sign-in on its own and needs no second step. The authenticator app is a second factor you can also use to confirm sensitive changes.

The tab shows the app under Authenticator app with the label Time-based codes, an On or Off badge, and the date it was Set up. When it is off the page says Use an app that makes a new code every 30 seconds as a second factor.

Setting up an app is not offered on every deployment. Where it is switched off, the page says Setting up an authenticator app is not available right now.

Set it up#

You need an authenticator app on your phone or another device. Any app that follows the common time-based one-time password standard works.

  1. Open Security, then the Two-step verification tab.
  2. Select Set up an authenticator app.
  3. In your app, add an account by scanning the QR code, whose label is QR code for your authenticator app. If you cannot scan, type the Setup key into the app instead. The key has a copy button.
  4. Type the six digits the app now shows into Code from the app and select Turn on.
  5. The page says Authenticator app turned on.
  6. If these are your first recovery codes, the page shows them now, with the title Your recovery codes. See Recovery codes.

If you change your mind before step 4, select Cancel setup. Nothing is turned on until you enter a valid code. A wrong code is refused with That code is not right or has expired.: check that your phone's clock is set automatically, and enter the code that is showing now.

Treat the setup key like a password. Anyone who has it can make your codes. It is shown only during setup.

Setting up asks for a recent second factor first, as every change here does. See The Security overview. Setup is also a security event: a notice goes to your verified addresses.

If your account signs in with a password only, the page first asks you to confirm your current password. The box is titled Add a second factor and says You sign in with a password only. Confirm your current password to set up an authenticator app. The page also says that a sign-in method can be added from a browser your account has known for 24 hours, and the password has to be that old as well: one chosen at registration or at a Choose a password step does not count for the first day. A browser becomes known only through a sign-in that proved more than the password (a passkey, an authenticator code, or a link or code emailed to you); a password alone never does, so sign in once with an emailed link or code and come back after a day.

The Two-step verification tab: the authenticator app is On, with a Turn off button, and the recovery codes card says 10 codes left, with a Create a new set button.
  1. The app, shown as Time-based codes with the On badge and the date it was set up.
  2. Turn off.
  3. The recovery codes, with how many are left. See Recovery codes.
Two-step verification: an authenticator app that is on, and its recovery codes. Sample data./account/security/two-step

Only one app at a time#

An account has one authenticator app. If one is already on, setting up another says An authenticator app is already set up. Turn the current one off first, then set the new one up. Do this when you move to a new phone.

Use it when you sign in#

When the sign-in page asks for a second step, type the current code. See Signing in. You can also type a code in the confirmation dialog whenever the account asks you to Confirm it is you before a sensitive change.

If you lose the phone, use a recovery code instead, then set up the app again.

Turn it off#

  1. Open Two-step verification and, beside the app, select Turn off.
  2. The dialog is titled Turn off the authenticator app? and says other signed-in devices are signed out.
  3. Confirm with Turn off. The page says Authenticator app turned off.

The device you are using stays signed in. A notice goes to your verified addresses. Turning the app off removes a second factor, so if it was your only one, add a passkey so you keep a strong way to confirm sensitive changes. When the Security overview says a second factor is required on your account, you cannot go without one.

Managed accounts#

An account that an organization manages (a managed identity) cannot add, change or remove its own sign-in methods here: those requests are refused, because the organization's directory connection is its only way in.

Related#

Verified against commit ca26dec