Two-step login with an authenticator app

Two-step login asks for a second proof after your password (or after Continue with Google, Microsoft or Facebook): a 6-digit code from an authenticator app on your phone. Someone who learns your password still cannot open your account. It is set per login: if your email has logins in several organisations, turn it on in each (they share one password, but each has its own two-step login).

Turn it on

1. Install an authenticator app on your phone, for example Google Authenticator, Microsoft Authenticator or 1Password.
2. In OmniBrand, open Your account (/app/account) from the account menu (your initials, top corner) and find the Two-step login card. It shows Off.
3. Click Turn on two-step login. Type your current password in Current password and click Continue. A login made with Google, Microsoft or Facebook has no password: click Continue within 10 minutes of logging in, otherwise log out, log in again and repeat. A QR code appears with three numbered steps.
4. In the app, add an account and scan the QR code. If you cannot scan it, click Can't scan the code? and type the key shown (time-based) into the app.
5. Type the 6-digit code the app now shows in Authenticator code and click Turn on. Turn on stays disabled until six digits are typed. A wrong or old code says "That code is not right. Check the time on your phone and type the newest code from the app."
6. Your recovery codes appear: ten codes like ABCDE-23456. Click Copy codes or Download (a file named omnibrand-recovery-codes.txt) and keep them somewhere safe; they are not shown again.
7. Tick I have saved my recovery codes and click Continue. "Two-step login is on." The card now shows On, "On since [date]." and "Recovery codes left: [count]." We also email your login when two-step login is turned on or off, so a change you did not make is noticed.

Logging in with it

1. On the log-in page, type your email and password (or use Continue with Google, Microsoft or Facebook) as usual.
2. If your email belongs to more than one organisation, the page first asks "Your email belongs to more than one organisation - pick one:". Pick the organisation and click Log in again. The code is asked next only if that organisation's login has two-step login.
3. The page changes to Two-step login: "Open your authenticator app and type the 6-digit code it shows for OmniBrand."
4. Type the code in Authenticator code and click Verify. You land where you would have before. Your session starts only now: until the code is accepted you are not logged in, and closing the page leaves you logged out.
5. The step lasts five minutes and accepts five wrong codes; after that it says "Too many wrong codes. Please log in again." Click Back to log in and start again. Each code works once, and repeated wrong codes lock two-step login for a while, like wrong passwords.
6. Accepting an invitation with a login that has two-step login asks for the code the same way before you enter the workspace.
7. Forgot your password? sets a new password (for every organisation your email signs in to) and logs out every session, but two-step login stays on: the next log-in still asks for the code, or a recovery code.

Recovery codes

• No phone at hand? On the Two-step login step, click Use a recovery code instead, type one code in Recovery code (with or without the dash) and click Verify. Each code works once; a wrong or used one says "That recovery code is not right, or it was already used. Each code works once." After it, the page says "Recovery codes left: [count]. Make new ones under Your account, Two-step login." Click Continue.
• To get a fresh set (for example after using some), click New recovery codes on the Two-step login card, type a current code from the app in Authenticator code (or click Use my password instead and type your Password), and click Make new codes. The ten new codes appear; every older code stops working.

Turn it off or move to a new phone

1. On the Two-step login card, click Turn off two-step login.
2. Type a current code from the app in Authenticator code, or click Use my password instead and type your Password (its eye button Show password shows what you typed; a login made with Continue with Google, Microsoft or Facebook has no password and uses a code). Click Turn off.
3. "Two-step login is off." The secret and every recovery code are deleted. To move to a new phone, turn it off and turn it on again with the new phone.

Require it for every member (Owners)

1. As an Owner of the account, open Settings → Members (/app/settings/members). At the bottom, the Two-step login card has Require two-step login for all members.
2. Turn on two-step login for yourself first: until then the box is disabled with "Turn on two-step login for yourself first." and an Open Your account link.
3. Tick Require two-step login for all members. "Two-step login is now required for all members." Untick it to make it optional again.
4. From the next log-in (or invitation accepted), every member without an authenticator app sees Set up two-step login: "Your organisation requires two-step login. Set up an authenticator app now to finish logging in." They scan the QR code, type a code, click Turn on, save their recovery codes and click Continue; only then are they logged in. Members without an authenticator app who are logged in when you tick the box are logged out at once, on every device, and are asked to set it up when they log in again. A member who turns their own two-step login off while it is required is logged out the same way.
5. Other members see the box disabled with "Only an owner of the account can change this." The Two-step login card on their Your account page says "Your organisation requires two-step login for all members."

If something goes wrong

• "That code is not right...": the phone's clock is probably off, or the code was already used. Set the phone's time to automatic and type the newest code.
• "This log-in step has expired or was already used. Please log in again.": more than five minutes passed, or the step was used. Click Back to log in.
• Lost your phone and your recovery codes? Email OmniBrand support at [support@omnibrand.app](mailto:support@omnibrand.app) from the address of that login (the sign-in code step says so too, with the address as a link: "Email OmniBrand support at support@omnibrand.app from this login's address..."). Once support has checked it is you, they turn two-step login off for that login; you then log in with your password and set it up again (if your organisation requires it, you are asked at once).
• Developer API keys are not affected: they never use two-step login. Keep them as secret as a password; see API access (for developers).

Related

• Your account
• Logging in and resetting your password
• Members and invitations