1. Docs
  2. Administrator Two-Factor Authentication

Administrator Two-Factor Authentication

A second factor for the people who administer your Canopy account: how to set one up, what happens at sign-in, how an account requires it, and what to do when a device is lost.

Overview

Your administrators are the people who sign in to the Developer Console and the Admin Workspace. Each of them can hold a second factor beside their password: an authenticator app or a passkey. The factor belongs to the person, not to any one account, so one enrolment covers every Canopy account they belong to, and it is checked at sign-in before any account is entered. This is separate from the multi-factor authentication of your application's end users, which is configured per Environment in the Developer Console.

No one in an account can reset another administrator's second factor, the owner included. Read the next section before anyone needs it.

Lost your device?

An administrator whose authenticator or passkey is gone has two ways back in, in this order.

A recovery code. 10 single-use codes were shown once, when the first factor was enrolled. On the sign-in challenge, choose Use a recovery code and enter one. Once in, open Your Profile, remove the lost factor and enrol a new one; the profile shows how many codes remain and issues a fresh batch on request.Canopy support. Without a recovery code, contact support from the email address on the account. Support verifies the person and clears their factors; the next sign-in enrols a new one.Not a colleague. There is no reset button in the Admin Workspace, by design: a factor also protects every other account the person belongs to, and a reset by one account's owner would be the weakest link in all of them.

Setting one up

Enrolment is self-service, from the profile page in either product.

Open Your Profile from the avatar menu and find Two-factor authentication.Add authenticator app shows a QR code and the key to type instead; enter the 6-digit code the app answers with and name the factor. Add passkey names the passkey and runs the browser's own prompt: a fingerprint, a face, a PIN or a security key.The first factor issues 10 recovery codes, shown once. Copy or download them and keep them somewhere other than the device you just enrolled.Adding another factor, removing one, regenerating the codes and changing the email address each ask for a fresh code from a factor you still hold. Each also sends a security notice to the account's email, so a change you did not make is noticed.

At sign-in

Once a factor is held, the password alone no longer signs in.

After the password, the Two-factor authentication step asks for the authenticator code, the passkey, or a recovery code. Only then is an account entered or offered.Ticking remember this device skips the step on that browser for as long as every account you belong to allows: the shortest of their settings, each 30 days unless an owner changed it. Your Profile lists the remembered devices and forgets any of them.A sign-in through single sign-on is challenged only where an account has asked for that; otherwise the identity provider's own sign-in stands.5 wrong answers lock the challenge; sign in again to get a fresh one.

Requiring it of every administrator

An account can insist that every administrator holds a factor. The policy lives in the Admin Workspace under Settings → Administrator Sign-In and needs account.manage: the requirement itself, a grace period counted from each administrator's next sign-in, whether single sign-on satisfies it, and how long a remembered device is trusted. Turning the requirement on needs a factor of your own. Administrators without one see the deadline in a banner until they enrol, and Administrators → Users shows who has.

Next Step

The policy, field by field, and the confirmation that turns it on.

Environment
API version
v1.0
 On this page Was this page helpful?

Tell us how we can improve this guide.

Canopy