Two-step sign-in

Two-step sign-in, called two-factor in the settings, asks for a code from an app on your phone after your password. The code is six digits and changes every 30 seconds. It protects password sign-ins. If you sign in with Continue with Google, your Google account's own security protects you instead, and the helpdesk does not ask for a code.

Anyone can turn it on for themselves. An owner can also make it compulsory for everyone who signs in with a password; see Require it for everyone.

Before you start#

You need an authenticator app on your phone. Any app that shows six-digit codes works, for example 1Password, Google Authenticator or Authy. Keep somewhere safe ready for ten recovery codes, such as a password manager.

Turn it on#

1. Open Settings > Two-factor sign-in.

2. Select Set up two-factor.

3. In your authenticator app, add an account and scan the code on screen. If you cannot scan, type the key shown below the code into the app.

4. Enter the six-digit code the app shows in Code from the app, then select Turn on.

5. Ten recovery codes appear. Select Copy codes, store them, then select I saved them. They are shown only this once.

The Status section now says On, when you turned it on and how many recovery codes are left.

Signing in with it#

After your email and password, the sign-in page asks for your code. Open the app and type the code it shows for Growth Dept Helpdesk. Each code works once.

Without your phone, type one of your recovery codes instead. Each recovery code works once, so the count on the settings page goes down by one.

Make new recovery codes#

When you are running low, or think someone has seen your codes:

1. Open Settings > Two-factor sign-in.

2. Under Manage, select Make new recovery codes.

3. Enter a code from your app and select Make new codes.

The new set replaces the old one completely, so throw the old codes away.

Turn it off#

1. Under Manage, select Turn off two-factor.

2. Enter a code from your app or a recovery code, and select Turn off.

If your organization requires two-factor, the button is greyed out and the page names the organization that requires it.

A new phone, or a lost one#

• New phone, old phone still working: turn two-factor off with a code from the old phone, then set it up again on the new one. Some authenticator apps can also move your codes to a new phone themselves.

• Lost phone, recovery codes at hand: sign in with a recovery code, turn two-factor off, then set it up again on your new phone. This also gives you a fresh set of recovery codes.

• Lost phone and lost codes: there is no reset button for admins in the helpdesk yet. Email support@growthdept.ai from your sign-in address so the Growth Dept team can help you back in.

Require it for everyone#

An owner of your organization can switch on Require two-factor for password sign-ins under Settings > Access. From then on, anyone who signs in with a password and has no authenticator app is asked to set one up at their next sign-in before they get in. People who sign in with Google are not affected. Access settings has the details.

Admins can see who has two-factor on in the Two-factor column of Settings > Users.