Two-factor authentication

Two-factor authentication adds a second step to signing in. After the code we email you, or after you continue with Google or GitHub, Inth asks for a 6-digit code from an authenticator app on your phone. Someone who gets into your inbox still can't sign in without that code.

Which authenticator apps work?

Any app that shows time-based one-time codes (TOTP), such as 1Password, Google Authenticator, Microsoft Authenticator, or Authy. Inth doesn't send codes by text message.

A password manager that stores authenticator codes, such as 1Password, keeps them on all your devices, so losing one phone doesn't lock you out.

How do I turn it on?

1. In the Dashboard, open Settings > Security.
2. Next to Authenticator app, select Set up.
3. Scan the QR code with your app. If you can't scan it, copy the setup key into the app instead.
4. Enter the 6-digit code the app shows, then select Turn on.

Nothing changes at sign-in until that first code is accepted. If you last signed in more than an hour ago, Inth asks you to sign in again before you can turn it on.

What does signing in look like afterwards?

Sign in as before: enter the code we email you, or continue with Google or GitHub. Inth then asks for the current code from your authenticator app.

The code changes every 30 seconds. If one is rejected, wait for the next one and try again. After too many wrong codes, Inth asks you to wait before you try again.

How do I turn it off?

Open Settings > Security, select Turn off next to Authenticator app, and confirm. After that, signing in needs only the emailed code, or Google or GitHub.

If you last signed in more than an hour ago, Inth asks you to sign in again first.

What if I lose my phone?

Inth doesn't offer backup codes. Email support from the address on your account. Before we remove the authenticator, another owner or admin of one of your organizations has to confirm the request in writing. You can then sign in with the emailed code and set it up again on your new phone.

If you're the only owner or admin, nobody can vouch for you, and we can't remove it. Before you turn two-factor on, do one of these:

• Make a teammate an owner or admin of your organization.
• Use an authenticator that syncs codes across devices, such as 1Password.

Who can see whether I use it?

Owners and admins of an organization can see whether two-factor authentication is on for each member, on the organization's Settings > Members page. Other members can't.

Does it apply to the Inth CLI and connected apps?

inth login signs you in through the Dashboard in your browser, so you enter your authenticator code there. Organization API keys in INTH_TOKEN and apps you've already connected keep working, because they don't sign in again.