Security: Authenticator App and Sessions

If you sign in with an email and password, you can add a second step: a 6-digit code from an authenticator app on your phone. Someone who learns your password still can't sign in without your phone.

If you sign in with Microsoft or Google, you don't need this. Your organisation's own sign-in already asks for a second step.

Open the Security Page

Choose your picture, or the person icon, at the top right. Under My Account, choose Security.

The page has two parts:

Authenticator app: set it up, move it to a new phone, or get new backup codes. This shows only if you sign in with a password.
Signed-in sessions: where you're signed in. Sign out of devices you no longer use.

Who Has to Set It Up

Administrators who sign in with a password must set it up. Until they do, the app shows Protect your admin account in place of every page. Choose Set up now, or Not now, sign out.
Everyone else who signs in with a password can choose to.
Contractors don't see the option.

Set Up the Authenticator App

You need an authenticator app on your phone, such as Microsoft Authenticator or Google Authenticator. It takes about 2 minutes.

On the Security page, choose Set up authenticator app.
Enter your password and choose Set up.
Scan the QR code with your authenticator app. If you can't scan it, type the key shown under it into the app instead.
Enter the 6-digit code your app shows under Code from your app, and choose Check code.
You see 10 backup codes. Save them somewhere safe, such as a password manager. Choose Copy codes to copy them all.
Tick I've saved these codes and choose Done.

You won't see these backup codes again. Each one works once, in place of a code from your app.

Signing In With a Code

After your email and password, you're asked for the Code from your authenticator app. Enter the newest code your app shows and choose Continue.

To skip the code on a browser you use every day, tick Don't ask for a code on this browser for 30 days. Each sign-in on that browser starts the 30 days again. Don't tick it on a shared or public computer.

When You're Asked to Re-verify

Some changes, such as editing your team, ask you to Re-verify your identity. Enter your Current password and choose Verify. If you have an authenticator app, you're then asked for the Code from your authenticator app too. This happens even on a browser you trust for 30 days.

Lost Your Phone

If you have a backup code:

On the code step, choose Lost your phone? Use a backup code.
Enter one of your backup codes and choose Continue.
You land on the Security page with a reminder. Choose Set up a new phone and follow the steps above. You get new backup codes.

If you have no backup codes left: ask another administrator in your organisation to reset your authenticator app. If you're the only administrator, or you use more than one organisation, contact IPGN support. IPGN checks it's really you before resetting it: it replies to your account's own email address and calls you back on a number it already holds.

After a reset you're signed out everywhere, on the web and in the phone app, and get an email saying so. The next time you sign in with your password, you set up the app again.

Reset Someone's Authenticator App

For administrators who can change settings:

Open Resources › Team and select the person.
Under their details, choose Reset authenticator.
Check it's really them asking, for example by phoning them on a number you already have. Then choose Reset.

You can't reset your own. If the person also uses another organisation, the reset is refused and they need to contact IPGN support.

Manage Your Authenticator App

On the Security page, under Authenticator app:

Set up a new phone: moves the app to a new phone. You get new backup codes.
New backup codes: replaces your backup codes. The old ones stop working.
Turn off: removes the second step. Administrators don't see this option.

Each one asks for your password first.

The Phone App

The phone app can't ask for an authenticator code yet. You sign in to it with your email and password as usual, and survey as normal.

If you're an administrator and sign in to the phone app with a password, its admin features aren't available there. Use them on the web, where you're asked for your code. If you sign in to the phone app with Microsoft or Google, nothing changes.

Troubleshooting

"That code isn't right." Use the newest code in your app; each one lasts about 30 seconds. Check your phone's clock is set automatically.
"This sign-in has timed out." Choose Back and enter your password again.
"That backup code isn't right, or it's been used." Each backup code works once. Try another.
No link arrives after "Set a password". If you sign in with Microsoft or Google, you don't need a password. You get an email saying so instead of a link. Keep signing in with Microsoft or Google.
You can't use admin features and see a message about an authenticator app. You sign in with a password and have admin access. Set up the app on the Security page.