Skip to main content

​
Security

​
What this is for

Passwords get guessed, reused and leaked. Two-factor sign-in adds a second step: after your password, the dashboard asks for a 6-digit code that changes every 30 seconds and is generated by an app on your phone. Someone who steals your password still cannot get in without your phone. The Security page is where you turn this on, add a second phone or app, and remove one.

​
Before you start

  • You need an authenticator app on your phone. Any standard one works, for example Google Authenticator, Microsoft Authenticator, 1Password or Authy. If you have none, install one first.
  • Every role can do this. It protects your own account only.
  • Keep your phone nearby; you will scan a code and read a code from it.

​
Turn on two-factor sign-in

1

Open Security

Select your initial (top right) to open the account menu, then Security. The page is titled Security with the line “Protect your account with a second step at sign-in.”
2

Start the setup

In the Two-factor authentication card, select Set up an authenticator app. A panel titled Set up an authenticator app opens.
3

Scan the QR code

In your authenticator app, choose to add an account and scan the square code on screen. If you cannot scan (for example you are on the same phone), select the copy button next to Can’t scan? Enter this key in the app and paste that key into the app by hand.
4

Enter the 6-digit code

The app now shows a 6-digit number. Type it into 6-digit code. Only digits are accepted.
5

Confirm

Select Verify and turn on. A message says Two-factor authentication is on and the badge at the top right of the card changes from Off to On.
If you close the panel with Cancel before confirming, nothing is turned on and the half-finished setup is discarded.

​
What you’ll see

  • The Two-factor authentication card with a badge: Checking… while it loads, then Off or On. Its button reads Set up an authenticator app, or Add another authenticator once you have one.
  • A card titled Your authenticators listing each app, its name (shown as “Authenticator app” or the name it was given), when it was Added, and a Remove button. Until you add one it reads None yet.
  • A card titled Unfinished setups appears only if you started a setup and never confirmed it. These protect nothing. Remove them to keep things tidy.
  • A note that your sign-in is shared with ClinikEHR (the same account), so an authenticator you add here also asks for its code when you sign in there.

​
Remove an authenticator

Select Remove beside it. A confirmation titled Remove authenticator says “You will no longer be asked for a code from this authenticator when you sign in.” Select Remove again to confirm. A message says Authenticator removed.

​
Check that it works

Sign out from the account menu, then sign in again. After your password you should be asked for a code before the console opens. Add a second authenticator (a different phone) as a spare so losing one phone does not lock you out.

​
Common questions

A free app that creates a new 6-digit code every 30 seconds from a secret it shares with the dashboard. It works offline, so you do not need signal to read the code.
It is optional and personal. Requiring it for every member of an organization is not available yet.
If your old phone still works, add the new one with Add another authenticator, then remove the old one. If the old phone is gone, you may not be able to remove it yourself (see Troubleshooting); contact support from the help menu.
Each time you start a setup, an entry is created. If you leave before confirming, it can stay behind. It is harmless, and you can remove it.
Yes, if you use it. It is the same sign-in, so an authenticator you add here is asked for there too.

​
Troubleshooting