Two-factor sign-in asks for a 6-digit code from an app on your phone each time you sign in with your password. Anyone who learns your password still can’t get in without your phone.
Before you start
Section titled “Before you start”- A Soosh account you sign in to with a password
- An authenticator app on your phone, like Google Authenticator, Microsoft Authenticator or 1Password
If you sign in with Google or your company’s sign-in, there’s nothing to set up: they check who you are themselves. See Sign in with single sign-on.
Turn it on
Section titled “Turn it on”- Click your name at the bottom of the sidebar, then Profile.
- Under Two-factor sign-in, click Turn on.
- Scan the QR code with your authenticator app, then click Next. If you can’t scan it, click Can’t scan it? Enter a setup key and type the key into the app. On a phone, tap Open in authenticator app instead.
- Enter your password, then the 6-digit code your app shows.
- Click Turn on.
- Save your 10 recovery codes: click Download or Copy all, and keep them somewhere safe, like a password manager.
- Tick I’ve saved these codes and click Done.
We email you to say it’s on. Other browsers signed in to your account are signed out, and sign in again with a code.
Sign in with it
Section titled “Sign in with it”After your password, Soosh asks for a code. Open your authenticator app and enter the 6-digit code it shows for Soosh. To use something else, click Try another way under Verify and pick:
- Email me a code: we email you a code for this sign-in.
- Recovery code: each code works once. We email you when one is used.
Signing in as someone else? Click Not you? next to your email at the top.
Change your sign-in email
Section titled “Change your sign-in email”With two-factor sign-in on, changing the email you sign in with takes your current password and a code from your app (or a recovery code), not your password alone. Codes by email go to that address, so this keeps someone who learns your password from moving them to their own inbox. You then sign in again everywhere, and we email your old address to say it changed.
Got a new phone?
Section titled “Got a new phone?”Move two-factor sign-in to it yourself. You need your old phone or one of your recovery codes. It stays on the whole time, even if a workspace requires it.
- In Profile, under Two-factor sign-in, click Use a new phone.
- Enter your password, then the 6-digit code from your old phone. Soosh goes on to the next step as soon as the code is complete. No old phone? Click Use a recovery code and enter one instead.
- Scan the QR code with the authenticator app on your new phone, then click Next.
- Enter the 6-digit code your new app shows. Soosh checks it as soon as it’s complete, and you’re done.
Codes from your old phone stop working. Your recovery codes stay the same (less the one you used, if you used one). Other browsers signed in to your account are signed out, and we email you to say it moved.
If you have neither your old phone nor a recovery code, write to the support address shown under the fields in Use a new phone (it’s also in Trouble signing in? under the sign-in form, and in our emails about two-factor sign-in). Without one, ask your workspace owner to contact Soosh support.
If codes from your app don’t work
Section titled “If codes from your app don’t work”Codes change every 30 seconds, so enter the newest one your app shows. If codes keep failing, your phone’s clock is probably off. Set your phone’s date and time to automatic in its settings, then try a new code.
If you lose your phone
Section titled “If you lose your phone”- Sign in with a recovery code, or with a code by email.
- Then move to your new phone, with a recovery code in place of a code from your old phone. Each code works once, so use a different one from the code you signed in with.
- If you have no recovery codes left, write to the address in Trouble signing in? under the sign-in form, in Use a new phone and in our emails about two-factor sign-in, or ask your workspace owner to contact Soosh support. Soosh support can reset it for you, and we email you when they do. You then sign in with only your password. If a workspace requires it, you’re asked to turn it on again straight away.