In short
Turn it on at Settings → Security. Scan one QR code with an authenticator app, type the 6 digit code it shows, and save the 10 backup codes you are given.
After that, signing in asks for your password and then a code. Nothing else about your account changes.
What it is
A password is one factor: something you know. Anyone who learns it can sign in as you. Two factor authentication adds a second factor, something you have, in the form of a phone running an authenticator app. Someone who steals your password still cannot get in, because they do not have your phone.
The app shows a 6 digit code that changes every 30 seconds. When you sign in, TimelyDo asks for that code after your password. The code is generated on your device from a secret shared once at setup, so it works even with no signal and no internet connection.
What you need
Any authenticator app that supports standard TOTP codes. TimelyDo does not tie you to one vendor. Popular choices:
Turning it on
The whole thing takes about a minute.
Your backup codes
When you turn two factor authentication on, you are given 10 backup codes. Each one works exactly once, and any of them can be used in place of a code from your app.
They exist for one situation: you no longer have the phone with your authenticator app on it. A lost, stolen, broken or wiped phone takes your codes with it, and without a backup code there is no way back into your account.
How to store them
- Your password manager, as a secure note
- Printed and kept somewhere physically safe
- An encrypted file on a different device
- A note on the same phone as the app
- An email to yourself
- A plain text file on a shared drive
Signing in
Sign in with your email and password as usual. Instead of landing in the app, you get a short page asking for your code.
Open your authenticator app, read the 6 digit code next to TimelyDo, and type it in. The form submits on its own as soon as you have entered six digits, so there is usually nothing to click.
Lost your phone? Type one of your backup codes into the same box instead. There is no separate mode to switch to, the box accepts either. That code is then used up and will not work a second time.
How often you are asked
Not every time you open the app. The Remember me box on the sign in form keeps you signed in on that browser for two weeks, and it is ticked by default. So in practice you enter a code roughly once a fortnight per browser, plus any time you sign in somewhere new.
If you would rather be asked more often, untick Remember me when you sign in. Signing out ends the remembered session everywhere, so the next sign in asks for a code again.
What is covered
A second factor is only worth having if it covers every door into your account, so it applies to all of these:
| Way in | Asks for a code | Notes |
|---|---|---|
| Email and password | Yes | The normal sign in |
| Sign in with Google | Yes | Google verifying you does not replace your own second factor, otherwise it would be a way around it |
| Password reset link | Yes | The reset still works, but you land on the code prompt. Access to your mailbox alone is not enough |
| Email confirmation link | Yes | Applies when you change your email address and confirm the new one |
| API key | No | Your API key keeps working for integrations. It cannot be used to turn two factor authentication off |
Generating new backup codes
Go to Settings → Security and select Generate new backup codes. You are asked to confirm with your password, then a fresh set of 10 appears.
Do this when you have used several codes, when you have lost the list, or when you think someone else may have seen it. The security card shows how many unused codes you have left.
Turning it off
Go to Settings → Security and select Turn off. You are asked to confirm with your password first.
If you signed up through Google and have never set a password, you are asked for a code from your authenticator app instead. A backup code works there too.
Turning it off deletes your backup codes and removes the pairing with your authenticator app. You can delete the leftover TimelyDo entry from the app afterwards. If you turn two factor authentication back on later, you set it up fresh with a new QR code and a new set of backup codes.
Email notices
We email you whenever two factor authentication is turned on or off, with the time the change was made shown in your own timezone. Generating new backup codes does not send an email.
These notices exist so that a change made by someone else still reaches you. If one of them arrives and it was not you, act on it. Change your password, turn two factor authentication back on, and contact us at support@timelydo.com.
Troubleshooting
My code keeps being rejected
- You are reading the code under the right account. Authenticator apps often hold many entries
- The code has not just expired. If it is about to roll over, wait for the next one
- You are not reusing a code you already used. Each code works once, even inside its 30 second window
I lost my phone
I lost my phone and my backup codes
I was sent back to the sign in page
How it works under the hood
For anyone who wants the detail:
| Standard | TOTP, defined in RFC 6238. The same standard every major site uses, which is why any authenticator app works |
| Codes | 6 digits, regenerated every 30 seconds, valid for about 90 seconds to allow for clock drift |
| Replay | Once a code is accepted it cannot be used again, even while it is still on screen |
| Attempts | Five wrong codes end the sign in attempt and you start over |
| Your secret | Encrypted in our database, not stored in readable form |
| Backup codes | Stored hashed, the same way passwords are, so they cannot be read back by anyone |
Frequently asked
Do I need internet on my phone to get a code?
Can I use the same setup on two phones?
Does this affect my attendees or my booking page?
Will my integrations break?
I signed up with Google and have no password. Can I still use this?
Can I be forced to use it by an admin?
Was this article helpful?
Let us know so we can keep improving our documentation.