Two-step verification
On a cloud deployment a password is followed by a code from an authenticator app. Setting it up, signing in with it, recovery codes, and what an administrator does about a lost phone.
A deployment that anybody on the internet can reach does not open on a password alone. After a correct password you are asked for a six-digit code from an authenticator app on your phone — Google Authenticator, Microsoft Authenticator, 1Password, Authy or any other app that reads a QR code. A stolen or guessed password then opens nothing.
Since 16 October you can also use a passkey, your device’s Windows Hello, Touch ID, Face ID or fingerprint, or a PIN on a device you trust, under Personalize › Sign-in methods. The authenticator app and recovery codes keep working. See Passkeys, fingerprint or face, and a PIN; administrators see Sign-in methods for administrators, where Reset sign-in methods replaces Reset two-step.
| Where you sign in | Asked for a code? |
|---|---|
| A cloud deployment (Google Cloud Run, Kubernetes, Azure App Service) | Yes, every time you sign in with a password. |
| A copy running on your own machine with Docker | No. The code step is switched off there. |
| Single sign-on through your company directory | No. Your directory asks for its own second step, and TRANXACT does not ask twice. |
Setting it up — the first time you sign in
Nobody has to do anything in advance. The first time you sign in with your password on a cloud deployment, the sign-in card asks you to set up two-step verification before anything else opens.
- Enter your email and password as usual.
- Open the authenticator app on your phone, add an account, and scan the QR code on the screen. If you cannot scan it, choose "Type the key instead" and enter the key the screen shows.
- Type the six-digit code the app now shows and choose Verify and turn on.
- Save the ten recovery codes: copy them, download them, or write them down. They are shown this once and never again.
- Tick "I have saved these codes somewhere safe" and continue. You are signed in.
The set-up waits fifteen minutes. If it runs out, or you close the page, sign in again and you get a new QR code; nothing was turned on until the code was accepted.
Signing in afterwards
- Enter your email and password.
- Open the app and type the six-digit code it shows for TRANXACT. The code changes every thirty seconds; one that has just changed is still accepted.
- Choose Verify.
- Each code works once. If you are refused with a code you just used, wait for the next one.
- After five wrong codes you are sent back to the password. Wrong codes count towards the same lock-out a wrong password does.
- The code step lasts five minutes. After that, enter your password again.
Recovery codes
If your phone is not to hand, choose "Use a recovery code" on the code step and type one of the ten codes you saved. Each works once, and the screen tells you how many are left. Under Personalize → Two-step verification you can make a fresh set of ten at any time with a current code; the old set stops working.
A new phone
- Open Personalize and scroll to Two-step verification.
- Choose Move to a new phone and enter a code from the old phone, or a recovery code.
- Scan the new QR code with the new phone and enter the code it shows. The old phone stops working at once, and you get ten new recovery codes.
Lost phone and lost codes: for administrators
Platform → Users has a Two-step column: On for people who have set it up, and "At next sign-in" for people who have not signed in since it was switched on. For somebody who has lost both their phone and their recovery codes, choose Reset two-step on their row.
- Their authenticator app and recovery codes stop working.
- Every session they hold ends at once.
- At their next sign-in they set up a new authenticator, exactly as the first time.
- The reset is recorded in the audit log. Nobody can see or set another person’s key.
A reset is the one way back for somebody locked out, so check it really is them — by phone or in person — before you do it. Anybody who can talk an administrator into a reset gets the account as soon as they know the password.
Assumed identity and the accountant’s window are opened by somebody already signed in with their own second step, so they are not asked for a code again. The same goes for scheduled jobs and API keys, which do not sign in with a password.
The operator console
The operator console for a multi-tenant estate (TMA) works the same way for operators: a code after the password, recovery codes, and Reset two-step on the Operators screen for another operator. When nobody can sign in, run npm run operator -- reset-mfa <email> in the cluster.