Two-factor sign-in and passkeys

There is no password for the customer account: you sign in with a link we email you, or with a passkey. Both are in your account under Security.

Add a passkey

A passkey is a key on your device (for example in iCloud Keychain, Google Password Manager, Windows Hello or 1Password). It is possession and key in one: whoever signs in with a passkey is not asked for a code afterwards.

1. 1

   Open Account, Passkeys and press Add passkey.

2. 2

   Enter a name (your device is suggested) and press Continue on device.

3. 3

   Confirm in your browser's or device's prompt. If your last sign-in was a while ago, the portal briefly checks that it is you first.

From then on you sign in on the sign-in page with Sign in with a passkey. The list shows where a passkey is stored and whether it syncs between your devices. Rename it with the pencil, remove it with the bin and a held confirmation.

Set up two-factor sign-in

Any authenticator app will do, such as those from Google, Microsoft, 1Password or Aegis. There are no SMS codes.

1. 1

   Open Account, Two-factor and press Set up.

2. 2

   In the app choose “Add account” and scan the QR code. If scanning does not work, type in the key shown.

3. 3

   Enter the six-digit code the app now shows and press Confirm.

4. 4

   Keep the 10 backup codes safe: copy them or Save as file, then Saved, done. They are shown only this once.

From then on the portal asks for the code after every sign-in by link. With Trust this device for 30 days it stops asking on this device for 30 days. If your phone is not at hand, use a backup code; each works once.

Briefly confirm that it is you

For a few things the portal wants a fresh sign-in (at most 10 minutes old): setting up two-factor, creating an API token, changing the sign-in email, setting the SFTP password, switching off deletion protection, deleting the account. If your sign-in is older, Briefly confirm that it is you appears in place: with your passkey, a code from the app or a code by email.

Signed-in devices

Under Account, Signed-in devices you see where your account is signed in. Sign out a single device there, or all others at once.

Security emails

We write to your account's address, in its language, when something about its security changes: with the time, the browser and the IP address, and what to do if it was not you. These emails cannot be turned off.

• A sign-in from a browser or network that has not come up for you in the last 90 days. More sign-in links in the same browser do not send one.
• Two-factor turned on or off, new backup codes, a passkey added or removed.
• A new API token.
• Someone accepted your team invitation.
• The sign-in address was changed: this email goes to the previous address.

Sign-ins from new devices, new backup codes and removed passkeys together at most five times an hour. Whatever opens a way in or switches protection off (two-factor, a new passkey, an API token, a team member, the address) is always reported. The same change twice within ten minutes is one email.

Too many wrong codes

After 5 wrong codes in one sign-in, request a new sign-in link. After 10 wrong codes in a row the account is locked for 15 minutes. If you have lost both the app and the backup codes, write to us at hello@goodflare.io.