Two-step sign-in

With two-step sign-in, signing in takes two things: your password, and a 6-digit code from an authenticator app on your phone. Somebody who steals or guesses your password still cannot get in. Every user can turn it on for their own account, on every plan.

Turn it on

1. Install an authenticator app on your phone, for example Google Authenticator, Microsoft Authenticator, 1Password or Aegis. Any app that makes time-based codes (TOTP) works.
2. In Heimdall, open the account menu → Profile & security → Security → Two-step sign-in, and choose “Set up two-step sign-in”.
3. Confirm your password, then scan the QR code with the app. If you cannot scan it, type the setup key shown under it.
4. Enter the 6-digit code the app shows. From that moment two-step sign-in is on.
5. Save the ten recovery codes you are shown next.

Recovery codes

When you turn two-step sign-in on you get ten recovery codes. Each one signs you in once, in place of a code from the app, for the day your phone is lost, broken or replaced. They are shown only once: keep them in a password manager or on paper, and not only on the phone itself.

• Your profile shows how many are left and warns you when they run low
• You can create a new set at any time with your password and a code; the old set stops working
• Every time a recovery code is used to sign in we e-mail you, with the number that is left

Where the code is asked for

• Signing in
• Setting a new password in your profile
• Closing your account
• Turning two-step sign-in off, and creating new recovery codes

In each of these places a recovery code works in place of the 6-digit code. After five wrong codes in a row no code is accepted for 15 minutes.

Password reset and API tokens

Resetting a forgotten password by e-mail does not remove two-step sign-in. The link lets you choose a new password; the next sign-in still asks for the code. Otherwise somebody who got into your mailbox would be in your account as well.

API tokens are not affected. They are separate credentials: they keep working as before and never ask for a code, so treat them like passwords and revoke the ones you no longer use.

If you lose your phone

If you still have recovery codes: on the sign-in page choose “Use a recovery code instead” and sign in with one. Then turn two-step sign-in off in your profile (that takes your password and one more recovery code) and set it up again on the new phone. You get a fresh set of recovery codes with it.

If the phone and the recovery codes are both gone, there is no way round the second step that you can use by yourself. A link by e-mail would make two-step sign-in only as strong as your mailbox. Write to contact@warewave.tech from the e-mail address of your account:

• We answer to that address, and go on only when you reply from it
• We may ask for details from your invoices, such as the last invoice number or amount, before we reset anything
• After the reset you are signed out everywhere and told by e-mail; you sign in with your password alone and can turn two-step sign-in on again