Using Two-Factor Authentication

While two-factor authentication is on, signing in asks for a 6-digit code from the authenticator app on your phone in addition to your password. Apps such as Google Authenticator, Microsoft Authenticator, Aegis or 1Password generate this code. Your e-mail address must be verified before you can set it up.

Turning it on

Open Security from the user menu.
On the Two-factor authentication (TOTP) card, press Start set-up.
Scan the QR code on the screen with the app on your phone. If you cannot scan the code, enter the key in the Set-up key field into the app by hand.
Enter the 6-digit code that the app shows in the Verification code field.
Press Verify and turn on.
Keep the eight recovery codes shown on the screen with the Copy codes or Download as a text file button.
Press I have saved the codes.

The recovery codes are shown only once, and each of them works once. Keep the codes somewhere safe, such as a password manager.

Signing in with a code

After you enter your password, the Two-factor authentication screen opens. Enter the current code from your app and press Verify. If you cannot access your phone, press the I can't use my phone — use a recovery code link and enter one of your recovery codes. Signing in with ORCID or an institution account also asks for the code.

Turning it off

On the Two-factor authentication (TOTP) card, press Turn off two-factor authentication.
In the dialog, enter your password and the current code from your app.
Press Turn off two-factor authentication in the dialog.

Once you turn it off, your account is protected by your password only.

Roles that require it

If the system administrator has turned on the Mandatory two-factor authentication for privileged roles flag, two-factor authentication is mandatory for these roles:

System administrator
Editor-in-chief
Section editor
Catalogue editor
Content editor
Production coordinator
Publishing board

If you have one of these roles and have not set it up, an alert bar appears at the top of the screen. The permissions of these roles do not work until the set-up is done. The Turn it on button in the bar opens the tab where you set it up.

If you have lost your phone and your recovery codes, see I cannot access my authenticator app.