Two-factor authentication in Leadnote

Two-factor authentication (2FA) asks for a 6 digit code from an authenticator app every time you sign in, on top of your password. A stolen or guessed password is then not enough to open your Leadnote account. You turn it on yourself from your profile, and setup takes about two minutes.

What you need

• An authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator, 1Password or Authy.
• Your Leadnote password.
• A safe place to keep your recovery codes, such as a password manager.

Turn on two-factor in the web app

1. Open Settings, then My Profile, and select the Security tab.
2. In the Two-factor authentication card, the status shows Off. Select Turn on two-factor.
3. Step 1 of 3: enter your password and select Continue. Leadnote asks again so that nobody can enrol their own phone on a session you left open.
4. Step 2 of 3: scan the QR code with your authenticator app. If you cannot scan, use Cannot scan? Enter this key manually, copy the setup key into the app, or select Open in an authenticator app on this device.
5. Enter the 6 digit code your app shows and select Turn on two-factor. Nothing is switched on until you enter a valid code, so any six digits will not do.
6. Step 3 of 3: save your recovery codes. Leadnote shows ten codes, once. Use Copy, Download or Print, tick I saved these recovery codes, then select Done.

The status now shows On, and the card lists the date you turned it on, how many recovery codes are left and how many trusted devices you have. Leadnote also sends you an email to say two-factor was turned on.

Sign in with a code

1. Enter your email and password on the sign-in page.
2. On the Two-step verification screen, open your authenticator app and type the 6 digit code for Leadnote into Authentication code.
3. Select Verify and sign in.

Codes change every 30 seconds. Leadnote also accepts the code from the step just before and just after the current one, so a phone clock that is a few seconds off still works. A code can be used only once.

You have 5 minutes between the password step and the code step. If that time runs out, Leadnote shows "Your sign-in expired" and you enter your password again.

Too many wrong codes

After 5 wrong codes, authenticator codes are locked for 15 minutes. The screen shows a countdown. A recovery code still works during the lock. Select Use a recovery code and enter one in the form xxxxx-xxxxx. Spaces, dashes and capital letters do not matter.

Skip the code on a browser you trust

When you sign in with a code, you can tick Trust this device for 30 days. That browser then skips the code step, but still asks for your password. Only tick it on a computer you control. You can remove trusted browsers at any time.

Turn off two-factor

1. Open Settings, My Profile, then the Security tab.
2. Select Turn off two-factor.
3. Enter your password and a code from your authenticator app. If you cannot reach the app, select Use a recovery code instead.
4. Select Turn off two-factor again to confirm.

After this, your account is protected by your password alone. Your recovery codes and trusted devices stop working, and Leadnote emails you about the change. If your organisation requires two-factor, you will be asked to set it up again at your next sign-in once the grace period is over.

On the mobile app

The Leadnote mobile app calls this two-step verification. After your password it asks for the 6 digit code, or a recovery code through Use a recovery code. The app has no "trust this device" option, so it asks for the code at every sign-in. If your organisation requires two-factor and you have not set it up, the app takes you through setup when you sign in. To turn two-factor on or off by choice, use the web app.

If you cannot sign in at all

If you have no phone and no recovery codes left, someone with a higher role can reset your two-factor:

• An Account Owner can reset anyone.
• A Manager can reset an L1 User or an L2 User, but not another Manager.

They open Users, find your row and select Reset two-factor. This removes the authenticator app, recovery codes and trusted devices, signs you out everywhere and emails you. You then sign in with your password and set up two-factor again.

Nobody in the organisation ranks above the Account Owner, so an Account Owner who has lost both the phone and the codes should contact support. For other sign-in problems, see I can't log in.