Sign in and two-factor authentication

Set up two-factor authentication, sign in with it, and get back into your account if you lose your phone.

Who needs two-factor

Every MakerOps account that signs in with an email and password needs two-factor authentication, whatever its role. After your password, you enter a 6-digit code from an authenticator app on your phone.

• Single sign-on: if you sign in through your organization, you don’t set it up in MakerOps. Your organization’s sign-in handles the second step. Passkeys aren’t available on these accounts: you always go through your organization.
• Passkeys: a passkey doesn’t count. You can keep signing in with one, but you still need an authenticator app.

Each person signs in as themselves. A shared login, such as one account for the front desk, isn’t supported: whoever is at the desk signs in with their own account.

Your deadline

The first time MakerOps sees you signed in without two-factor, it gives you 14 days to set it up. It emails you once, with the date and a Set up two-factor button.

• Until the deadline: each page shows a banner, “Your workspace requires two-factor authentication. Set it up by …”, with the date. The link opens the setup page.
• After the deadline: signing in takes you to Settings › Security with “Your workspace requires two-factor authentication. Set it up here to continue.” The rest of MakerOps stays closed until two-factor is on. You can still sign out.

Owners and Admins needed two-factor before everyone else did. If you were already given a deadline, it stays the same.

Set up two-factor

You need an authenticator app on your phone, such as Google Authenticator, 1Password or Microsoft Authenticator.

1. On the web, open Settings › Security.
2. Under Two-factor authentication, click Enable 2FA. If MakerOps asks for your password, enter it.
3. In your authenticator app, scan the QR code. If you can’t scan it, copy the key under “or, enter the code manually” into the app.
4. Click Continue.
5. Enter the 6-digit code your authenticator app shows, then click Confirm. Two-factor is now on.
6. Save your recovery codes. The last step shows 8 recovery codes, with Copy, Download and Print. Put them somewhere safe, such as a password manager or on paper, tick I’ve saved these somewhere safe, and click Done. Each code works once, and they get you in if you lose your phone. MakerOps never emails them.

You can see your codes again any time: Settings › Security › 2FA recovery codes › View recovery codes. Regenerate codes replaces them all, and shows the new ones with the same save step.

If you set up two-factor before the save step existed, a banner asks you once to save your codes: “Save your two-factor recovery codes …”. It goes away for good when you view them.

In the app: open More › Security and follow the same steps there: Set up two-factor, add MakerOps to your authenticator app, enter the code and Turn on two-factor, then save your recovery codes.

Once it is on, two-factor can’t be turned off, so Settings › Security has no Disable 2FA button. If you lose your phone, see Lost your phone or authenticator app.

Sign in with two-factor

1. Enter your email and password as usual.
2. Enter the 6-digit code from your authenticator app.

• Web: tick Trust this browser for 30 days and that browser skips the code for 30 days. Don’t tick it on a shared computer.
• App: the app asks for the code once, when you sign in.

To use a recovery code instead, click login using a recovery code on the web, or tap Use a recovery code instead in the app.

Move two-factor to a new phone

Got a new phone? Move two-factor to it yourself:

1. Open Settings › Security on the web and click Move to a new phone.
2. Enter your password and a code from your current phone. If you no longer have that phone, enter one of your recovery codes instead; it’s used up when you do.
3. Scan the new QR code with the authenticator app on your new phone, or copy the key into it.
4. Enter the 6-digit code your new phone shows and click Switch to this phone.
5. Save your new recovery codes, as when you set up. Your old phone and your old recovery codes stop working.

Until you click Switch to this phone, your old phone keeps working, so closing halfway changes nothing. A started move expires after 15 minutes. You get an email when two-factor moves. Wrong passwords and codes here count toward the sign-in limits in Too many wrong passwords.

In the app: More › Security › Move to a new phone does the same, ending with Switch to this phone.

Lost your phone or authenticator app

If you saved your recovery codes, sign in with one, then move two-factor to your new phone. You don’t need an admin.

No recovery codes? Ask your space’s admins to reset your two-factor:

1. Sign in with your email and password.
2. On the code screen, click Lost access to your authenticator app?
3. Click Ask your workspace admin to reset it.

MakerOps tells the Owners and Admins of your spaces who can reset it, and the screen names who was asked. If none of them can, MakerOps support is asked instead. Asking again within 24 hours sends nobody a second message.

An admin may check with you that it’s really you. Once they reset it, you get an email. Sign in with your password and you go straight to setting up two-factor again, with no new grace period.

In the app: on the code screen, tap Lost access to your authenticator app? and ask from there.

Reset someone’s two-factor

When a member loses their authenticator app, an Owner or Admin can reset it. First confirm it’s really them, in person or through a phone number or email you already know.

1. Open the person in People › Members & Groups.
2. If they asked for a reset, a notice at the top of their page says so. Click Reset two-factor. Otherwise, find Two-factor under Info and click Reset.
3. Enter Your password and click Reset two-factor. Their next sign-in takes them to setting up two-factor again.

The reset turns off their authenticator code in every space they belong to; their passkeys stay. They get an email, and the Owners and Admins of their other spaces are told which space reset it.

Who can reset whose two-factor:

• Only the Owner and Admin roles can reset two-factor. A permission can’t grant it.
• You need two-factor on your own account first. If you sign in through your organization (single sign-on), you don’t: in step 3, click Confirm with your organization’s sign-in instead of entering a password. Sign in at your organization, and you come back to the dialog. Click Reset two-factor within 5 minutes.
• You can’t reset your own. Sign in with a recovery code and move it to a new phone, or ask another admin.
• Someone who is an Owner of any space can only be reset by a fellow Owner of a space they both own.

The Two-factor row also shows whether someone has it On, Not set up, or signs in Through SSO. Only Owners and Admins see it.

Too many wrong passwords

MakerOps pauses sign-in when a password or code is wrong too often.

• 5 wrong tries from one place in 15 minutes: that place is locked out of your account for the rest of the 15 minutes. A correct sign-in resets the count.
• 20 wrong passwords or codes for your account in an hour, from anywhere: password sign-in to your account is paused for 60 minutes, even with the right password. You get one email about it.

During a pause you can still sign in with a passkey, or from a browser you chose to trust. If you didn’t cause the pause, change your password in Settings › Security once you’re signed in. The messages are on Troubleshooting.