Two-factor authentication | Help
Skip to content

Two-factor authentication

31 help pages

For password sign-in, use Profile to enable two-factor authentication:

  1. Open the two-factor setup.
  2. Scan the QR code with an authenticator app, or enter its setup key manually.
  3. Enter the app's six-digit code to confirm setup.
  4. Save the recovery codes in a secure place outside this browser.

At sign-in, enter an authenticator code. If the app is unavailable, use an unused recovery code. Each recovery code can be used once. Each authenticator code also works once: if you are asked for a code again within the same 30 seconds (for example right after signing in), Sentinel says "This code has already been used. Wait for the next code in your authenticator app." Enter the next code when your app shows it; this does not count as a failed attempt. You can generate replacement recovery codes from Profile; the old set then stops working.

Codes by SMS

Phone codes are available only when the platform has switched on phone messaging and phone codes; otherwise Profile and sign-in show only the authenticator app and recovery codes. They are an extra method next to the authenticator app, never instead of it.

  • Prerequisites: the authenticator app is set up and you have a confirmed mobile number (Mobile number card in Profile). Accounts that sign in only with Google or GitHub have no password, do not see the Two-factor authentication card and cannot use phone codes.
  • Profile card: Two-factor authentication lists Authenticator app (On), Codes by SMS (with your masked number and "codes come by SMS") and Recovery codes (New recovery codes). Next to phone codes select Turn on or Turn off. Without a confirmed number the row shows an Add mobile number link instead. Turning phone codes on or off asks for a fresh code (the "Confirm it's you" dialog). Once on, Offer first at sign-in lets you choose Authenticator app or SMS code. The Turn off two-factor authentication button turns off phone codes too.
  • Platform administrators must keep the authenticator app; their card says so. They can sign in with a phone code, but Confirm it's you always asks them for the app or a recovery code.
  • At sign-in: after your password, Choose how to get your code lists Authenticator app (the preferred method is tagged Usual), SMS and Use a recovery code. On the code screen, Resend code appears after a countdown (60 seconds by default); Use another method goes back. Codes expire after 10 minutes. Sentinel sends at most 5 codes an hour for your account or number, and applies a limit per network. If Sentinel is sending too many phone codes overall, codes by phone are refused for a while with "We cannot send codes by phone right now. Use your authenticator app, or try again later." The same step is used for OpenID Connect and command-line device sign-in.
  • Too many wrong codes: five wrong codes, of any method, pause sign-in for 15 minutes for every method, including recovery codes. Wait, then try again.
  • Confirm it's you: sensitive actions can accept a phone code, except for platform administrators (app or recovery code only). Changing or removing your mobile number needs the authenticator app or a recovery code; if you try a phone code the dialog refuses it and asks again for the app.
  • If your number goes away: removing your mobile number turns phone codes off. The authenticator app and recovery codes keep working, and the security email says so. Adding a number again does not turn phone codes back on; select Turn on again. If support disables your number, phone codes stop.

An organisation can require two-factor authentication for password sign-in. In that case, setup is required and you cannot turn it off. Google and GitHub sign-ins are not asked for a Sentinel authenticator code. Sensitive actions can ask for a fresh code while you are already signed in.

For normal accounts, a successful Confirm it's you check can cover further sensitive actions for up to 10 minutes, including after you reload the same tab. Reloading does not restart that time. Signing out or changing accounts clears the confirmation. If your browser cannot retain it, a reload can require another code. Follow any new code prompt shown for the action.

If you lose both the authenticator and recovery codes, ask your administrator for help. An authorised administrator can reset a member's two-factor setup after checking their identity. An organisation administrator cannot reset another administrator's two-factor setup; contact support for that case. An administrator also cannot reset it for a person who belongs to another organisation that the administrator does not administer; Sentinel then says to contact Sentinel support. The service checks the target account's roles before allowing a reset. A reset invalidates the old app secret and codes, records the action, and sends an email. Set up two-factor authentication again when required.