Trusted Devices and New Sign In Alerts

Jump to section

In short

Sign in from a browser TimelyDo does not know and you get a 6 digit code by email. Enter it, leave Remember this device for 60 days ticked, and that browser skips the code until the 60 days are over.

See and remove your devices at Settings → Security. If a new sign in email says it was not you, one button signs everyone out.

Overview

What it is

A password on its own proves very little. Anyone who learns it can try it from anywhere. So when your password is entered in a browser that has never signed in to your account before, TimelyDo asks for one more thing: a short code it sends to your email. Only someone who can read your mailbox can finish the sign in.

Once you have entered the code you can tell TimelyDo to remember that browser. A remembered browser is called a trusted device. It skips the code for 60 days, so everyday sign ins stay quick.

Nothing to switch on. This is part of signing in for every account. It is separate from two factor authentication, which is optional and uses an authenticator app.

Who is asked

Everyone who signs in with an email and password from a browser that is not remembered. There are two exceptions:

You use two factor authentication. Your authenticator code already checks the device, so you are not sent an email code as well. See Two Factor Authentication.
You sign in with Google. Google checks the device itself, so there is no email code. You still get the new sign in email when the browser or country is new.

Signing in

Signing in from a new browser

Enter your email and password as usual

If they are right and the browser is new to your account, you are taken to a page that asks for a code.

Open the email from TimelyDo

The subject starts with the code, so many mail apps show it without opening the message. It goes to your account's main email address and works once, for 10 minutes.

Enter the 6 digit code

Type it or paste it. Spaces are fine. It is sent for you as soon as you have typed all six digits.

Choose whether to remember the browser

Remember this device for 60 days is ticked by default. Untick it on a computer you share or do not own, and you will be asked again next time.

Five tries per code. After five wrong codes the sign in starts over, and a code that has expired or been replaced no longer works. Select Send a new code if you need another. You can ask again after 30 seconds, and the old code stops working.

Remembering a device

A remembered device skips the email code for 60 days, counted from the day you entered the code. Using the browser does not extend it. After 60 days you are asked for a code once more and can remember it again.

The browser keeps a small private cookie for this. That has a few results worth knowing:

A different browser, a private window, or another computer is a new device and asks for a code.
Clearing your cookies forgets the device. Your next sign in asks for a code.
Two accounts on the same browser are both remembered.
Changing your password, or resetting it, removes every remembered device on your account.

Remembering a device is separate from Remember me on the sign in page. Remember me keeps you signed in. Remember this device only decides whether the email code is asked.

What is covered

Here is how each way into your account behaves.

Way in	Email code	Notes
Email and password	Yes	Only on a browser that is not remembered, and only without two factor authentication
Sign in with Google	No	Google checks the device. You still get the new sign in email for a new browser or country
Password reset link	No	The reset email already proves your mailbox. Every remembered device is removed
Email confirmation link	No	A link sent to your mailbox, used when you change your email address
Two factor authentication on	No	You enter your authenticator code instead
API key	No	Integrations keep working. An API key cannot manage your trusted devices

Managing

Your trusted devices

Open Settings → Security and find the Trusted devices card. It lists every browser that is remembered on your account.

Each row shows the browser and system, when it was last used and when its trust ends. The one you are using is marked This device.
Remove forgets one device. The next sign in from it asks for a code.
Remove all forgets every device. You stay signed in on the browser you are using.
Recent security activity below the list shows your last sign ins, codes asked for, wrong codes and alerts, with the browser and country. Entries are kept for 90 days.

Removing a device does not sign it out if it is already signed in. To end every session, use This wasn't me from a new sign in email, or change your password.

New sign in emails

When your account is used from a browser or a country it has not been used from before, TimelyDo sends you an email so you can check it was you. It shows the browser and system, the approximate location and the time.

An email is not a block. The sign in has already happened, or was held by the code, and the email only lets you react. To keep your inbox quiet it is sent at most once every 10 minutes, and never for your very first sign in. A location comes from the network address, so a VPN or a mobile network can show a different country than the one you are in.

If it was you

Nothing to do. Close the email.

If it was not you

Select This wasn't me in the email and then Secure my account. TimelyDo signs out every device, removes every remembered device and emails you a link to choose a new password. The link works once and expires after 7 days. Opening the email by itself changes nothing, so a mail scanner cannot trigger it.

Help

Troubleshooting

I did not get the code

Check the address first

The code goes to your account's main email address, even if you signed in with a linked address. Look in spam, then wait 30 seconds and select Send a new code. Each new code replaces the one before, so use the newest email.

The code is rejected

Expired, replaced or mistyped

A code works once, for 10 minutes, and a newer code replaces it. After five wrong tries the sign in starts again. Go back to the sign in page, enter your password and use the fresh code.

I am asked for a code every time

The browser is not being remembered

Make sure Remember this device was ticked. A private window, a browser set to clear cookies on exit, or a cleaner tool forgets the device. Allow cookies for timelydo.com and tick the box once more.

I got an email about a sign in that was me

Probably a new browser, a VPN or travel

The email is sent for any browser or country your account has not used before. A new laptop, an updated browser that reports itself differently, or a VPN will do it. You can ignore it.

How it works under the hood

A correct password alone never signs you in. Until the code is right you are not signed in to anything, and closing the tab simply ends it.
The code is random, single use and kept only as a one way fingerprint for 10 minutes. It is emailed straight away and not placed in a queue.
A remembered browser holds a random secret in an encrypted, private cookie. TimelyDo keeps only a one way fingerprint of it, so a copy of the database cannot be used to sign in.
The sign in activity keeps the browser, system, country and a shortened network address, and is deleted after 90 days.

Frequently asked

Do I have to turn this on?

No. It is on for every account and there is nothing to set up. You only choose whether to tick Remember this device when you enter the code.

I use two factor authentication. Will I get the email code as well?

No. If two factor authentication is on, your authenticator code is your device check, so you are not sent an email code. You still get the new sign in email when a browser or country is new.

Does this affect people who book with me?

No. It protects your own sign in only. Your booking page, links and attendees do not change.

Will my API key or integrations stop working?

No. Connected calendars, Zoom, Stripe, webhooks and your API key keep working as before. An API key is not asked for a code.

Can someone steal my remembered device?

The browser holds a random secret that only works for your account, and TimelyDo stores only a one way fingerprint of it. If you lose a laptop or think a browser is not safe, remove it under Settings, Security, or change your password to remove every remembered device at once.

What if my email is not reachable right now?

You need the code from your account's main email address to sign in from a new browser. Sign in from a browser you have remembered, or use the password reset on your main email address once you can reach it.

Was this article helpful?

Let us know so we can keep improving our documentation.