Two-factor sign-in
With two-factor sign-in, when signing in you need a code from an app on your phone in addition to your password (or the code by email). Someone who only knows your password can't get into your account. Two-factor sign-in is optional and applies only to you, not to the whole team.
Suitable apps
You need an authenticator app that generates codes according to the TOTP standard. For example:
- Google Authenticator (Android, iPhone)
- Microsoft Authenticator (Android, iPhone)
- 1Password, Bitwarden or another password manager with one-time codes
- Authy or FreeOTP
The app shows a new 6-digit code every 30 seconds. It works without an internet connection; the only thing that matters is that the time on your phone is correct.
Setting up
- In the dashboard, open Settings → Profile and click Set up next to "Two-factor sign-in".
- In your authenticator app, add a new account and scan the QR code. Without a camera, type in the key shown.
- Enter the 6-digit code that the app shows for ShortBoost, plus your password for security (without a password, we send you a code by email), and click Activate. Only now is two-factor sign-in switched on.
- Save the 10 recovery codes as a text file or copy them into your password manager. They are shown only this one time.
By default, we sign out all your other devices at this point. They then sign in again, already with a code from the app. You get an info email for every change.
Signing in with two-factor
You sign in as usual with your password or with the code by email. After that, ShortBoost asks for the current code from the app. The second step is valid for 5 minutes and for at most 5 attempts, after which you simply sign in again. Each code from the app works only once: if you just used it, wait for the next one.
After 10 wrong codes, we lock the two-factor check of your account for 15 minutes, and longer after further failed attempts (up to 24 hours). From the third wrong code on you get a warning email. If it wasn't you, someone probably knows your password: change it immediately.
Even when you are signed in, we ask for the code from the app when you change your password or your email address or create a new API key.
Recovery codes
A recovery code looks like this: abcde-fgh23. You enter it when signing in instead of the app code if you don't have your phone at hand. Each code works exactly once. You can see how many you have left in your profile. When a code is used, you get an info email.
You create new codes in your profile under New recovery codes. For that you need your password and a current code. The previous codes no longer work afterwards.
Lost phone or new phone
- New phone, old one still there: Sign in, switch off two-factor sign-in in your profile and set it up again with the new phone. Some apps can also transfer accounts directly to a new phone.
- Phone gone, recovery codes available: Sign in with a recovery code. Then switch off two-factor sign-in and set it up again so that the lost phone no longer counts.
- Phone and codes gone: Write to us from your account's email address at support@shortboost.one. After a check, we reset two-factor sign-in. All your devices are signed out in the process, and you get an info email. Then you sign in again with your password and set it up again.
Switching off
In your profile, click Switch off next to "Two-factor sign-in" and confirm with your password and a current code from the app or a recovery code. If you haven't set a password, we send you a confirmation code by email instead.