What is two-factor authentication (2FA)?
Two-factor authentication is also known as "2-step verification" or "multifactor authentication".
PocketSmith uses time-based one-time password for two-factor authentication.
When you have 2FA set up, you'll need both your PocketSmith username and password as usual, and PocketSmith will also ask you to provide an extra code that only you have access to.
You will need to use an authenticator app that generates a limited-time code that you enter when logging into PocketSmith.
Activating 2FA on your PocketSmith account drastically reduces the risk of unauthorised access. Someone trying to log in to your account would need not only your username and password but also access to your authenticator app.
Setting up two-factor authentication
Select an authenticator app
First, make sure you have set a password for your PocketSmith account, then choose an authenticator app. Some possible authentication apps are:
For convenience, you can set up multiple devices (such as your tablet and phone) using the same activation code.
Note
If you created your PocketSmith account using Google login and haven't added a specific PocketSmith password you will need to add one in order to set up 2FA.
You can add a password as shown in the following user guide: Add a password to a PocketSmith account with Google a login.
Set up two-factor authentication
Follow the directions below to set up two-factor authentication:
- Head to the Profile menu menu and select Security & integrations
- Click Two factor authentication located in the menu on the left-hand side and confirm your PocketSmith account password in the confirmation box provided
- Click the Start two factor authentication setup button to begin pairing your PocketSmith account with your authenticator app
- Use your chosen authenticator app to scan the QR code displayed or manually copy the code shown.
Then, enter the 6-digit code generated by your authenticator app, and click Confirm Code.
- On the next screen, you'll be able to download your recovery codes as a text file.
These codes are very important. They will allow you to log in to your account should you lose access to your authenticator app. Download them and keep them safe! You will need to tick the checkbox that you have saved your recovery codes in order to confirm and finish the set up process.
Warning: Don't lose your recovery codes
PocketSmith Support cannot restore access to accounts with two-factor authentication enabled.
Be sure to download and keep your recovery codes in a safe place so you're never locked out of your account.
Using two-factor authentication on your PocketSmith account
Once you've set up your account for 2FA, PocketSmith will ask you for your 2FA code whenever you sign in. This limited-time code will generate on your authenticator app.
Enter the code from your 2FA app in the field provided and click Validate
Tip
If you don't want to be asked for a 2FA code every time you sign in from a trusted device, tick the option to Remember this device for 30 days. PocketSmith will remember your device, and you will not be asked for your two-factor code when signing in using the device for 30 days.
Once the 30 days expires you will be asked for the 2FA code once again.
Turning off or resetting 2FA on your PocketSmith account
You may want to temporarily disable 2FA on your PocketSmith, for example, if you are transferring to a new smartphone and therefore need to reset your 2FA app.
- Head to the Profile menu and select Security & integrations
- Click Two factor authentication located in the menu on the left-hand side and confirm your PocketSmith account password in the confirmation box provided
- Click Turn off two-factor authentication
- Enter your password to confirm the removal of 2FA from your account
- If you'd now like to re-setup 2FA on your account, follow the steps outlined here: Two-factor authentication: How to set up.
Storing and using your recovery codes
Recovery codes are single-use and can be used to access your account in the event you lose access to your device and cannot receive two-factor authentication codes
Don't get locked out - store your recovery codes!
Upon completing 2FA setup in the app, PocketSmith will provide you with recovery codes. You must download or print these and keep them somewhere safe. A text file is available for download for convenience.
Warning: Don't lose your recovery codes!
PocketSmith Support cannot restore access to accounts with two-factor authentication enabled.
Be sure to download and keep your recovery codes in a safe place so you're never locked out of your account.
Using your recovery codes if you lose access to your authentication app
If you lose access to your authentication app, you'll need to use one of your Recovery codes to regain access to your PocketSmith account.
- Locate the recovery codes you downloaded when setting up 2FA on your account
- Sign in using your login details, and when the 2FA screen appears, click Use a recovery code instead
- Enter your one-time recovery code exactly as provided and click Validate
Be sure to include all dashes, for example 123456-123456-123456-1
Note
Each recovery code can only be used once.
PocketSmith will generate additional recovery codes as you use them and it's important to update your copy of your recovery codes if you have used one to sign in. You can find the steps to generate new recover codes in the section below.
How to generate new recovery codes
If you've lost your previous recovery codes, or you suspect they have been seen by a third party, you can generate new codes:
- Head to your Profile menu > Security & integrations, then select Two factor authentication from the left menu
- Confirm your password, then click Show your recovery codes
- Click Generate all new recovery codes
- Once your new codes have been generated, click Download. Your new codes will be downloaded as a .txt file - be sure to squirrel them away and keep them safe!
2FA: Frequently asked questions
What if I don't want to be asked for a code each time I sign in?
You can choose to Remember your device for 30 days by selecting the checkbox on the two-factor code entry page. PocketSmith will store your device details, and you will not be asked for your two-factor code when signing in from this device for 30 days. After the 30-day period, you will need to enter your 2FA code again.
My 2FA code is not working. How do I fix it?
Check that your device has the correct time and date.
- If you're using iOS and see that your time is set to 'automatic', try toggling that setting off for a few seconds and then turning it back on.
PocketSmith uses Time-based one-time password for 2FA, so if the time on your device is slightly wrong, the generated codes can be invalid. This is a common cause of 2FA issues, so we want to ensure that’s not the issue before diving deeper!
After double-checking the date/time, try entering your 2FA codes again. If it still doesn't work, please get in touch, and we can take a closer look.
How do I access my recovery codes?
You must download a copy of your recovery codes when setting up your 2FA. You will not receive these via email or text message.
I’ve received an error message, ‘Two-factor confirmation failure count exceeded’. What should I do?
If you enter the wrong 2FA code too many times, you’ll receive a warning stating ‘Two-factor confirmation failure count exceeded’. If this happens, contact our support team to have the failure count reset before you can attempt to sign in again.