Two-step verification
Turn on two-factor authentication with an authenticator app, sign in with a code or a backup code, and require it for your whole organization.
Syncek supports two-step verification, also called two-factor authentication or 2FA, on every account. You turn it on in Settings, then Personal, then Security: scan a QR code with an authenticator app, type the 6-digit code it shows, and save ten single-use backup codes. From then on, signing in with a password, Google or GitHub asks for a code as a second step. Admins and the Owner can also require it for everyone in the organization.
Turning it on
- In Settings, then Personal, then Security, under Two-factor authentication, click Set up.
- If your account has a password, type it in Confirm your password. Click Continue.
- Scan the QR code with your authenticator app. If you can't, type in the key under Can't scan it? Enter this key: instead.
- Type the 6-digit code the app shows and click Turn on.
- Save the backup codes with Copy or Download, tick I've saved these codes somewhere safe and click Done. They are not shown again.
Two-step verification stays off until step 4 succeeds. Setting it up, turning it off and generating new backup codes need a sign-in from the last 15 minutes. If yours is older, Syncek asks you to sign in again first.
Signing in
After your password, Google or GitHub, the Two-step verification page asks for the 6-digit code from your app. Click Verify. Two links offer the other ways: Email me a code instead, which sends one valid for 3 minutes, and Use a backup code instead. Each backup code works once.
Trust this device for 30 days is ticked by default, so that browser skips the code when you sign in on it again.
Trusted devices and new backup codes
Trusted devices, in Settings, then Personal, then Devices, counts the devices that skip the code. Revoke all makes each of them ask again at its next sign-in, and so does Sign out on the same page.
Generate new codes, under Backup codes on the Security page, gives you a new set. The old codes stop working straight away.
If you lose your phone
Sign in with a backup code or an emailed code. On the Security page, click Turn off, then Set up again with the new phone. Your old backup codes stop working when you turn it off. If you cannot sign in at all, see the last section.
Requiring it for everyone
Settings, then Organization, then Security has the Two-factor for everyone switch. Only Admins and the Owner can change it, and to switch it on they need two-step verification on their own account. Syncek first says how many people have not turned it on yet, and Require two-factor confirms. From their next visit, anyone without it sees Two-factor authentication required and cannot use the organization until they set it up.
Admins and the Owner also see Two-factor activity on that page, newest first. It lists events such as turning it on or off, wrong codes, used backup codes, resets and changes to the requirement.
Resetting it for someone else
In Settings, then Organization, then Users and teams, open the menu at the end of the person's row, choose Reset two-factor and confirm. Their authenticator app and backup codes stop working, the devices they trusted are forgotten, they are signed out everywhere, and an email asks them to set it up again.
- Reset two-factor appears only for people who have two-step verification on.
- The Owner can reset it for Admins, Members and Guests, and an Admin for Members and Guests. Nobody can reset the Owner's this way, or their own.
- It needs a sign-in from the last 15 minutes.