Sign-in and two-step security
Two-step sign-in with an authenticator app, Google or Microsoft sign-in, company sign-in with SAML and SCIM, idle sign-out and signing out everywhere.
What it is
Every person signs in with their own account. One account can belong to several businesses; after sign-in you choose which one to open. On top of the password, the business can ask for a two-step code from an authenticator app, connect its own identity provider for company sign-in, and sign people out when they are idle.
Each sign-in is its own session, so a person can be signed in on a phone and a laptop at once and be signed out of one or all of them.
Who it is for
- Owners who must protect the business's books and customer data.
- Businesses with an identity provider such as Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud or ADFS.
- Every person who wants to secure their own account.
Before you start#
- Only the business owner can change the access policy and company sign-in.
- For two-step sign-in, each person needs an authenticator app on their phone.
- Turn on your own two-step sign-in before you require it for others.
Step by step#
- Open your own account page and choose Turn on two-step sign-in.
- Scan the code with your authenticator app, then enter the 6-digit code it shows.
- Keep the backup codes it gives you somewhere safe.
- As owner, open Settings › Access policy and set Two-step sign-in to Each person chooses, Required for the owner and settings administrators, or Required for everyone.
- Set Sign people out when idle: Never, After 15 minutes, After 30 minutes, After 1 hour or After 4 hours.
- Press Save.
Two-step sign-in#
When it is on, every sign-in asks for a code from the authenticator app. When the business requires it, anyone it applies to who has not turned it on yet can open only their own account page until they do. The secret behind each person's code is stored encrypted. API keys are not affected — they are not a person signing in.
Google and Microsoft sign-in#
The sign-in page also offers Google or Microsoft. It signs in an existing account with the same e-mail; it never creates a new one. Google is accepted only for a verified e-mail, and Microsoft only when the domain owner verified the e-mail.
Company sign-in (SAML) and provisioning (SCIM)#
On Settings › Access policy › Company sign-in (SSO) and provisioning, the owner connects the business's identity provider:
- Copy the Entity ID (audience) and the Assertion consumer service URL (HTTP-POST) into your identity provider.
- Paste the provider's Identity provider entity ID (issuer), its Sign-in URL (SAML 2.0, HTTP-Redirect) and its Signing certificate(s) (a second one may follow while the provider rotates keys).
- Enter the E-mail domains your people sign in with. A domain can belong to one business only.
- Switch Company sign-in on, and optionally make it Required: everyone except the owner must use it to open this business.
- For provisioning, press Create token, copy the SCIM base URL and the token into your identity provider, and choose the Role new people get.
People then sign in at the company sign-in page with their work e-mail, or through the Direct sign-in link for your people. Responses must be signed (SHA-256), and the e-mail must be in one of your domains. Company sign-in never creates an account: the person must already be a member, by invitation or by SCIM. The owner can always sign in with a password — the way back in if the identity provider is down or misconfigured.
The SCIM token is shown only once. Anyone with it can add and switch off people in the business, so keep it in the identity provider only; Replace token or Revoke token when needed. Provisioning never gives Admin and never touches the owner.
Sessions and signing out#
- Sign out everywhere on a person's account (for admins) ends every session they have and revokes their API keys; they can sign in again with their password.
- Setting a new password signs the person out of other devices. Passwords are at least 8 characters.
- Switching a person off (Active — can sign in unticked) stops them signing in.
Limits and what is not there yet#
- Company sign-in starts from this app (service-provider initiated); sign-ins started from the identity provider's own portal are refused.
- Two-step sign-in works with an authenticator app.
Questions#
What if I lose the phone with my authenticator app?
Use one of your backup codes to sign in, then set two-step sign-in up again on the new phone.
Does requiring two-step sign-in lock people out?
No. Until they turn it on, they can open only their own account page, where they set it up.
What if our identity provider is down?
The owner can always sign in with a password and change the company sign-in settings.
Can a former employee still use an API key?
Not after Sign out everywhere: every session they have ends and their API keys are revoked. Then untick Active — can sign in so they cannot sign in again.