Two-factor sign-in and passkeys

Two-factor sign-in protects your account with a second proof: after your password, a sign-in link or Google, Microsoft and other providers, Contals also asks for a code from an authenticator app on your phone. A passkey – your fingerprint, your face or the PIN of your device – counts as both factors. You set up both on your profile; organization owners can require two-factor sign-in.

Open your profile (avatar → Profile and settings), go to Two-factor sign-in and choose Set up. If your account has a password, confirm it first. Scan the QR code with an authenticator app – for example Google Authenticator, Microsoft Authenticator, Aegis or a password manager; if you cannot scan it, type the key shown below the code into the app. Enter the 6-digit code the app shows and choose Turn on.

Turning it on signs out your other devices: sign in there again with a code. You get an e-mail about the change.

2. Keep your recovery codes

Right after you turn it on, Contals shows ten Recovery codes. Each one signs you in once if you lose your phone. They are shown only this one time: Copy or Download them, keep them in a password manager or printed, and choose I saved them.

Sign in as usual. Then the page Two-factor sign-in asks for the Code from the app; enter it and choose Continue. Instead, you can Use a recovery code or, if you added one, Use a passkey instead. If the code is refused, check the time on your phone and try the next code. After too many wrong codes, Contals asks you to sign in again or locks two-factor sign-in for 15 minutes.

A sign-in link only proves the first factor: its page leads to the code step too. Signing in through your organization’s own single sign-on needs no code from Contals – your organization’s identity provider is responsible for the second factor there.

Passkeys

A passkey signs you in without a password and without a code.

Add one: profile → Passkeys → enter a Name of the passkey (for example “Phone” or “Laptop”) → Add a passkey, then confirm with your fingerprint, face or device PIN. Synced passkeys are marked Synced; you can keep up to ten.
Sign in: on the sign-in page, choose Sign in with a passkey. A passkey also answers the code step after another way of signing in.
Rename or Remove a passkey in the list. Adding and removing one is e-mailed to you.

If your organization requires single sign-on for your address, you cannot add passkeys – only the organization’s owners keep them, as an emergency way in.

New recovery codes or turning it off

New recovery codes: enter a code from the app (and your password, if your account has one) and choose Confirm. The old recovery codes stop working at once.
Turn off: enter a code from the app or a recovery code (and your password, if any) and choose Confirm. You get an e-mail about it. If your organization requires two-factor sign-in, you cannot work in it again until you set it up anew.

Setting it up, new recovery codes, turning it off and adding or removing a passkey need a sign-in within the last 24 hours. Otherwise the page asks you to Sign in again first.

When your organization requires it

When an owner switches on Require two-factor sign-in, everyone who works in the organization – members, volunteers, viewers, admins and board guests – sees only the page Set up two-factor sign-in until they have done it; it takes a minute with an authenticator app. Contals checks the requirement on the server, also for card links and API tokens. People who sign in through the organization’s required single sign-on are covered by its identity provider. A passkey meets the requirement too: whoever has one counts as “with two-factor sign-in”, and then a password, a sign-in link or a provider asks for the passkey as the second step. An owner with only a passkey can switch the requirement on.

Lost your phone?

You still have your recovery codes: sign in with Use a recovery code. Then turn two-factor sign-in off with another recovery code and set it up again on your new phone.
You lost the recovery codes too: ask an owner of your organization. An owner can reset your two-factor sign-in if you work in no other organization; otherwise Contals support does it. After a reset, your authenticator app, your recovery codes and your passkeys stop working, you are signed out everywhere and you get an e-mail. Sign in again and set it up anew.

For organization owners

Organization settings → Two-factor sign-in shows how many people have it on, how many board guests do not, and everyone With two-factor sign-in and Without two-factor sign-in. Admins see the section; only owners change it.

Require two-factor sign-in can be switched on once you have turned two-factor sign-in on for yourself.
Reset next to a person turns off their two-factor sign-in and removes their passkeys – for someone who lost their phone and their recovery codes. It is offered for people who have two-factor sign-in on and work in no other organization, and it needs a sign-in within the last 24 hours. First check that it is really them asking, for example by calling them. The reset is recorded in the audit log, and the person gets an e-mail.