Multi-factor authentication (MFA) adds a second check at login: after your password you enter a six-digit code from an authenticator app on your phone or computer. The codes are time-based (TOTP), change every 30 seconds and work offline. Most apps work, for example Microsoft Authenticator, Google Authenticator, Bitwarden or 1Password.
Where: click your name and avatar at the bottom of the side menu and choose Settings. The Multi-Factor Authentication section shows whether MFA is currently Enabled or Disabled.
When you set it up
|
Situation |
What happens |
|---|---|
|
You choose to |
Click Setup MFA under Settings at any time. |
|
Your company requires it |
At login you are taken straight to the setup page with the notice that your company requires MFA. You cannot use the account until setup is done; Log me out, I will set up this later signs you out instead. The company-wide switch is described in Account setup and company settings. |
Set up MFA
-
Click your name and avatar at the bottom of the side menu and choose Settings.
-
Under Multi-Factor Authentication, click Setup MFA. If your company requires MFA you land on this page directly after login and can skip the first two steps.
-
In your authenticator app, add an account and choose to scan a QR code.
-
Scan the code on Setup Multi-Factor Authentication. If scanning fails, open Problems scanning the QR code? and type the key shown under Copy this key into your authenticator app into the app instead, as a time-based, six-digit account.
-
Enter the code the app now shows into Passcode and click Enable Multi-Factor Authentication.
-
You are logged out. Log in again with your password and a fresh code from the app. From now on every login asks for one.
The QR code and key are only valid for a short time. If you see The secret has expired and must be refreshed, click Refresh secret, delete the half-finished account in your app and scan again. To have a backup device, scan the same code with a second authenticator before you click Enable.
Change or remove MFA
|
You want to |
Do this |
|---|---|
|
Move to a new phone and still have the old one |
Under Settings, click Reset MFA and run the setup again with the new device. |
|
Switch MFA off |
Click Remove MFA and confirm with your password. Not possible while your company requires MFA; the button then shows why. |
|
You lost the authenticator |
You cannot log in. Use Have you lost access to your authenticator app? on the login page, which points you to support@chaintraced.com. Support resets MFA after verifying with someone in your organisation. There are no recovery codes. |
Troubleshooting
|
Problem |
Fix |
|---|---|
|
Every code is rejected |
Set the date and time on the device with the authenticator to automatic. Time-based codes fail when the clock is off. |
|
A code is rejected once |
Wait for the next code and try again; you may have typed one that just expired. |
|
The login times out |
Enter the code promptly after your password; start the login again if it timed out. |
Keep the authenticator app and device locked, never share the key or a screenshot of the QR code, and consider MFA on your email account too, since a password reset goes through email.
Related
-
Account setup and company settings: requiring MFA for the whole company.