Identity and sign-in
Two-step verification
Autessa two-step verification adds a second step after your password: a 6-digit code from an authenticator app, or a code sent to your email. Turning on your first method gives you single-use recovery codes, and changing any setting needs a current code, so a stolen session cannot quietly switch it off.
The problem
What problem does it solve?
Passwords leak, get reused and get phished. A second factor means a stolen password alone is not enough to get into your Autessa account and everything you have built there.
How it works
- 1
Add an authenticator app
Open Account → Password & sign-in. Scan the QR code with an app such as Google Authenticator, Microsoft Authenticator or 1Password, or type the key, then enter one code to confirm. The QR code is drawn in your browser.
- 2
Or turn on email codes
Autessa emails a code to your account address. Enter it to confirm the emails arrive, and email codes are on.
- 3
Save your recovery codes
Your first method comes with ten recovery codes. Each works once. Download or copy them and keep them somewhere safe.
- 4
Sign in with the second step
After your password, enter the code from your app, ask for an email code, or use a recovery code. When you use one, Autessa tells you how many are left.
Every option
Two-step verification: settings and options
| Setting | What it does |
|---|---|
| Authenticator app (TOTP) | Any standard authenticator app. One code confirms setup. |
| Email codes | Sent to the account address, with a 30-second wait before resending. |
| Recovery codes | Ten single-use codes. Make ten new ones at any time; the old ones stop working. |
| Removing a method | Needs a current code from any method. Removing the last method also deletes the recovery codes. |
| Wrong codes | Repeated wrong codes are rate limited, and a sign-in that waits too long times out. |
Permissions
Who can do what?
| Who | What they can do |
|---|---|
| Every member | Turn two-step verification on or off for their own account and manage their recovery codes. |
| Changing settings | Always needs a current code from one of the member’s own methods or a recovery code. |
What to know
- Each member turns on two-step verification for their own account. To enforce a second factor for everyone, require SSO and set MFA at your identity provider.
- If your phone’s clock is off, authenticator codes fail. The error message says so.
Connections
How Two-step verification connects to the rest of Autessa
Reports, policies and security questionnaires are on the Autessa Trust Center.
FAQ
Two-step verification: questions
Which authenticator apps work with Autessa?
Any standard authenticator app that reads a QR code or a setup key, such as Google Authenticator, Microsoft Authenticator or 1Password.
What if I lose my phone?
Sign in with one of your ten recovery codes, or with an email code if you turned email codes on, then set up the authenticator app again.
How do I make sure everyone signs in with a second factor?
Require SSO for your verified domains and enforce MFA at your identity provider. Members can also turn on two-step verification for their own accounts.
Get started with Two-step verification
Autessa includes two-step verification: after the password, members enter a 6-digit code from an authenticator app or from email, with single-use recovery codes as a backup.
Reports, policies and questionnaires live on the Autessa Trust Center.
100% customizable, code and all
Make Autessa Security & Compliance fully your own.
Use it out of the box, then change anything. Ask Autobot, Autessa’s AI builder, for a new field, screen, report, workflow or agent and it builds it into your copy of the app. Or open the code and edit it yourself. Nothing is locked: the app, its data and its code are yours.
Start free and make it yours