Two-factor authentication

Add a second step to sign-in with an authenticator app or an emailed code, keep recovery codes, remember trusted browsers, and require it for a company.

Two-factor authentication adds a second step after your password. Avaloi offers an authenticator app, an emailed code, and ten recovery codes. Neither of the first two needs a phone number.

Choose a method

Open Account settings, then Security, then Two-factor authentication.

Authenticator app. Works with 1Password, Authy, Google Authenticator, and any app that makes 6-digit time codes. This is the stronger choice.
Email code. Avaloi emails a 6-digit code to your account address each time you sign in. The code works once and expires in 10 minutes. You get five tries per code, and a new code can be sent every 30 seconds.
Text message. Not available yet. The option shows as Coming soon.

You can turn on both the app and email codes. Turning on email codes alone is better than nothing, but anyone who controls your inbox can also reset your password, so the app is safer.

Set up an authenticator app

Choose Set up next to Authenticator app and enter your password.
Scan the QR code with your app. If you cannot scan, type the setup key, or on a phone choose Open in an authenticator app.
Enter the 6-digit code from the app and choose Turn on.
Save your ten recovery codes. Copy or download them. You will not see them again.

After your password, Avaloi asks for a code. Pick the app, an emailed code, or a recovery code. Choose Remember this browser for 30 days to skip the second step on that browser. Avaloi still asks for your password.

Ten wrong codes in a row across sign-ins lock the second step for your account for 15 minutes, and one address can try at most 15 wrong codes in 15 minutes.

Recovery codes

Each of the ten recovery codes works once. Use one if you lose your phone. Under Security, Recovery codes shows how many are left. Make new codes gives you ten new ones and cancels the old ones. Avaloi stores only hashes of the codes, so it cannot show them to you again.

Recovery codes come with the authenticator app. If you use only email codes, you have no recovery codes. If you lose access to your email too, Avaloi support can help through a recovery request that needs two of three proofs. Support never turns off two-factor in chat.

Trusted browsers

The Trusted browsers list shows each browser you chose to remember and when it expires. Forget removes one, and Forget all removes every one. Turning off two-factor, changing your password, or resetting your password forgets them all.

Turn off a method

Choose Turn off next to a method and enter your password. Avaloi forgets your trusted browsers and signs out your other sessions, then emails you a security notice.

Require it for your company

An Owner or Admin can require two-factor for every member under Company settings. A member who signs in with a password and has no second step is sent to Security and can use nothing else until they set one up. Members who sign in only with Google, GitHub, or your company's single sign-on are not held there, because those providers have their own two-step checks.

Quick answers

I got a new phone. Sign in with a recovery code, set up the app on the new phone, then make new recovery codes.

The code from my app is rejected. Check that the time on your phone is set automatically. Codes are time based.

Does email code work if I am signed in with Google? Google sign-in does not use Avaloi's second step. Use Google's own two-step verification there.

API

POST /v1/users/me/two-factor/totp
POST /v1/users/me/two-factor/totp/confirm
POST /v1/users/me/two-factor/email
POST /v1/users/me/two-factor/email/confirm
POST /v1/users/me/two-factor/disable
POST /v1/users/me/two-factor/recovery-codes
GET /v1/users/me/trusted-devices
DELETE /v1/users/me/trusted-devices/{id}
POST /v1/auth/two-factor/verify
POST /v1/auth/two-factor/email/send

Still stuck?

Email [email protected] with your site name and what you tried, or send us a message.