Sign-in with an authenticator app for owners and managers

Owners and managers can change money, people and settings, so they sign in with two things: the password and a six digit code from an authenticator app. You will be able to set the app up once and use it at every sign-in.

Before you start #

• Use any authenticator app on a phone, such as the ones from your phone's app store. They are free.
• Other roles sign in with a password only.

Set it up #

1. Sign in with your email and password. The server answers that the authenticator needs set-up (totp_enrolment_required).
2. Ask for set-up with your email and password. You receive a secret and a link for the app.
3. Add the secret to the authenticator app. Scan the code or type the secret.
4. Type the six digit code the app shows. The server confirms and the app is linked.

Sign in afterwards #

1. Enter your email and password.
2. Enter the six digit code. A code works once, so wait for the next one if you have just used it.
3. You are in. The code is accepted one 30 second step either side of the right time, so keep the phone clock on automatic time.

If you lose the phone #

The person who runs the server clears your authenticator with one command: dispatch-server reset-totp --tenant <business> --user <email>. You then sign in with your password and set up again on the new phone. The same command works for the owner.

If something goes wrong #

• "The code is wrong": check the phone clock, then try the next code.
• Locked after several failures (8 in a row): wait for the lockout to end, then try again.