Two-factor authentication

Two-factor authentication (2FA) adds a second step when you sign in with a password: a 6-digit code from an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator, 1Password or Authy. WatchTower15 uses authenticator apps only: no phone number and no SMS.

Two-factor authentication belongs to you, not to an organisation: once it is on, every password sign-in asks for a code, whichever organisation you then open.

Setting it up

On the Authentication tab of your Profile, the Two-factor authentication card reads Status: Off. Choose Set up:

Scan the QR code with your authenticator app. If you can’t scan it, choose Copy key and enter the key in the app instead.
Enter the 6-digit code the app shows, then Verify.
Save your ten recovery codes. They are shown only this once: Copy or Download them and keep them somewhere safe, then choose I have saved these codes.

The card then reads Status: On, with when you turned it on and how many Recovery codes left.

If you must sign in with single sign-on, the card is not shown: your identity provider handles your second factor, as it does for passkeys.

Signing in with a code

After your email and password, the sign-in page asks for the Authentication code: enter the 6-digit code your app shows, then Verify.

Each code works once, and the app shows a new one every 30 seconds. A phone clock that is a little off is allowed for.
You have five minutes after your password to enter the code. After that, or after five wrong codes, start again from your password: Back returns to it.
Wrong codes count toward the password lockout, together with wrong passwords: 5 wrong attempts within 5 minutes lock password sign-in for 10 minutes, and you get an email. Only a completed sign-in, with the right code, clears the count.
That code is not right. Try again, or use a recovery code. means the code was wrong or already used. Check the time on your phone if it keeps happening.

Signing in with a passkey or with single sign-on never asks for a code: your device confirms a passkey with your fingerprint, face or PIN, and your identity provider applies its own second factor.

A sign-in from a browser and operating system you have not used recently sends you a new sign-in email once it completes, after the code, naming the method as Password and authenticator app or Password and recovery code.

Recovery codes

A recovery code signs you in once when you can’t use your phone: on the code step, choose Use a recovery code instead and enter one of your codes (xxxxx-xxxxx). Use a code from the app goes back.

You get ten, and each works once.
When two or fewer are left, the card warns you: Only 2 recovery codes are left. Make new ones before you run out.
New recovery codes asks for a code from your app, then shows ten new codes. The old ones stop working at once.

Turning it off, or moving to a new phone

Turn off asks for your current password and a code from the app or a recovery code. If an organisation you belong to requires two-factor authentication, the dialog says so: that organisation asks you to set it up again at your next visit.

To move to a new phone, Turn off, then Set up again with the new phone. Changing or resetting your password leaves two-factor authentication as it is.

When an organisation requires it

An organisation can require two-factor authentication of its members: on Organisation → Settings → Authentication, the Two-factor authentication card’s Edit (settings.edit) turns on Require two-factor authentication. The card shows Members with two-factor on (such as 3 of 5) so you can see who it would affect before you turn it on. You need two-factor authentication on your own account first, unless you sign in with SSO in that organisation.

While it is on:

A member without it is sent to a set-up page at their next visit to the organisation: {Organisation} requires two-factor authentication. They set it up there, with the same steps as on the Profile, and Continue to {Organisation} takes them back to the page they were on. They stay signed in, but can reach nothing else in that organisation until it is on. Use another organisation and Sign out are always there.
Their other organisations are not affected.
Members who sign in with SSO in that organisation are exempt.
API keys are not affected: a key is its own credential, governed by the API Keys card.

The 2FA column on Users

With users.view, the 2FA column on Organisation → Users shows each member’s state, and a member’s page shows the same under Two-factor:

Tag	Means
On	The member has two-factor authentication on.
Off	The member has not set it up.
Required	The member has not set it up, and this organisation requires it: they will be sent to the set-up page.
SSO	The member signs in with SSO here, so the requirement does not apply to them.

Lost your phone and your recovery codes

If you belong to one organisation, ask one of its Admins. On your page under Organisation → Users, Reset two-factor turns it off for you, after asking: your authenticator app and recovery codes stop working and you are signed out. If the organisation requires two-factor authentication, you set it up again when you next sign in. Admins see the button on a member who has two-factor authentication on, and never on themselves.
If you belong to more than one organisation, no Admin can reset it: This person also belongs to other organisations, so only WatchTower15 support can reset their two-factor authentication. An Admin of one organisation must not be able to lower your protection in another. Contact support.

What’s recorded

The audit trail records Two-factor authentication turned on, turned off, Two-factor recovery codes replaced, Signed in with a recovery code (with how many are left) and Two-factor authentication reset by an Admin. A sign-in records its method: password+totp with a code from the app, password+recovery_code with a recovery code.

Organisation settings — the card that requires it.
Single sign-on & passkeys — the other ways to sign in.
Roles & permissions — who can reset it.