Sign in and set up two-factor authentication
Sign in to the console, protect your account with an authenticator app and recovery codes, change your password, and reset a forgotten one.
You sign in to the console with your email address and your password. With two-factor authentication (2FA), you also enter a code from an authenticator app, so that your password alone isn't enough to sign in.
Before you begin
- You need an account. See Create an account, or accept the invitation that you received from your organization.
- For 2FA, you need an authenticator app on your phone, such as Google Authenticator, 1Password, or Authy.
Sign in
On the console's sign-in page, enter your Email and Password, and select Sign in.
If your account has 2FA, enter the 6-digit code from your authenticator app in Authentication code. If you don't have your app with you, enter one of your recovery codes instead.
Select Verify and sign in.
The console opens the project that you last worked in on this browser, or your default project. See Choose your default project.
- The code step. After your password is accepted, you have 5 minutes and 5 attempts to enter a code. After that, select Start over, and sign in with your password again.
- Organizations that require 2FA. When an owner turns on the 2FA requirement for your organization and you haven't set up 2FA, the console asks you to set it up at your next sign-in, before you can finish signing in. See What members see at sign-in.
- Session length. A session lasts 12 hours from the time you sign in, whether you're active or not. Then the console asks you to sign in again. See Manage sessions.
To sign out, open the account menu at the right end of the top bar, and select Sign out.
Failed sign-ins
After 5 failed sign-ins in a row, your account is locked for 15 minutes. While it's locked, even the right password is refused, with the same message as a wrong one: Couldn’t sign you in. Please try again. Wait 15 minutes, or reset your password: a new password lifts the lock at once.
When a sign-in fails, the message offers Reset your password. See Reset a forgotten password.
Set up two-factor authentication
Every member can set up 2FA for their own account.
In the console, go to Identity & AccessAuthentication.
Under My account, in Two-factor authentication, select Set up authenticator.
Scan the QR code with your authenticator app. If you can't scan it, select the copy button next to the Manual entry key, and enter the key in the app.
Enter the 6-digit code that the app shows in Verification code, and select Verify & enable.
Save your recovery codes. Select Download to save them as a text file, or copy them into a password manager.
Important
The recovery codes are shown only this once. If you lose your phone and your recovery codes, you can't sign in until a member with Manage access to Identity & Access removes your second factor. See If a member loses their authenticator.
Two-factor authentication now shows 2FA active. From your next sign-in, you enter a code after your password. Some actions also ask for a code while you're signed in. See Step-up verification.
To stop a setup that you've started, select Cancel setup. 2FA isn't on until you've confirmed a code.
The app shows a new code every 30 seconds. If the console refuses codes that the app shows, check that your phone sets its time automatically.
Recovery codes
- You get 10 recovery codes, in the form
XXXX-XXXX-XXXX-XXXX. - Each code works once. Enter it in Authentication code instead of a code from the app. Dashes, spaces, and letter case don't matter.
- Recovery codes left shows how many unused codes you have.
Generate a new set. If you've used up your recovery codes or lost them, create new ones:
In the console, go to Identity & AccessAuthentication.
Under Recovery codes, select Regenerate.
Save the new codes, for example with Download, which saves them as a text file.
The previous codes stop working. Like the first set, the new codes are shown only once.
To turn off 2FA, see Turn off 2FA for your account.
Change your password
In the console, go to Identity & AccessAuthentication.
Under Change password, enter your Current password.
Enter the New password, and enter it again in Confirm new password.
If your account has 2FA, enter the 6-digit code from your app in Authenticator code.
Select Update password.
The new password must be at least 12 characters long. The page shows any other rules as you type.
Changing your password signs you out of all your sessions, including the one you're using. Sign in again with the new password.
Reset a forgotten password
On the sign-in page, select Forgot password?.
Enter your email address, and select Send reset link.
Open the link in the email that you receive. The page checks the link when it opens.
Enter a new password in Password and Confirm password, and select Reset password. The password must be at least 12 characters long. The page shows any other rules as you type.
The console returns to the sign-in page. Sign in with the new password.
- One link, 30 minutes. The link works once, and it expires 30 minutes after it's sent. If it has expired, request a new one.
- Same answer for every address. The page confirms that a link was sent whether or not the address has an account. An invited member who hasn't set a password yet gets no link: they use their invitation instead.
- What a reset changes. Setting a new password signs you out of all your sessions and lifts a lock from failed sign-ins. Your 2FA stays on.
If the link can't be used, the page says why:
| Message | Cause | What to do |
|---|---|---|
| This reset link has expired. Request a new one to continue. | The link is more than 30 minutes old. | Select Request a new link. |
| This reset link has already been used. Request a new one if you still need to change your password. | The link was already used to set a password. | Sign in with that password, or request a new link. |
| This reset link isn't valid. Make sure you opened the full link from the email, or request a new one. | The link is incomplete, or it has expired or was already used. | Request a new link with Request a new link. |
Troubleshooting
| Message | Cause | What to do |
|---|---|---|
| Couldn’t sign you in. Please try again. | The email address or the password is wrong, the account is locked after 5 failed sign-ins, or the account has been deactivated. | Check your password, wait 15 minutes, or reset your password. If your account has been deactivated, ask an owner of your organization. |
| Too many sign-in attempts. Wait a few minutes before trying again. | Too many sign-in requests came in a short time. | Wait a few minutes, and sign in again. |
| Invalid or expired code. Please try again, or restart the sign-in. | The code is wrong, the 5 minutes for the code step are over, or its 5 attempts are used up. | Enter a current code. If it's still refused, select Start over. |
| Check your current password and try again. | The current password that you entered for the password change is wrong. | Enter your current password again. |
| Check the 6-digit code from your authenticator app. | The authenticator code for the password change is wrong. | Enter the current code from your app. |
| This new password doesn’t meet the requirements. | The new password breaks a password rule: it's shorter than 12 characters, or it breaks a rule the page shows as you type. | Choose a password that meets every rule on the page. |