Sign-in codes

Anyone with a hosted account can turn on a sign-in code. Owners and admins must: until they do, they can see everything in their workspace but change nothing — no connecting a computer, no change to limits, keys, billing or people. A Viewer can look either way, and may turn their code off again; owners and admins keep theirs on.

The code comes from an authenticator app on your phone (or a password manager that makes six-digit codes): a new one every 30 seconds. After your password, signing in asks for it.

Open Settings, then Security, and choose Set up; or open Sign-in code from the account menu. It asks for your password, then shows a QR code, the setup key as text and a link: scan the code with your app, type the key in, or open the link on the phone that has the app. Enter the six digits the app shows and your password again, and the code is on. The set-up belongs to the sign-in that started it: no other sign-in to your account can see it or finish it.

Ten recovery codes are shown once. Each works once, in place of the app, if your phone is lost. Copy them or download them and keep them somewhere safe; they cannot be shown again, only replaced.

Turning the code on signs every other sign-in to your account out and emails you. If you did not do it, someone has your password: write to axigatelabs@gmail.com from your address at once.

An ordinary change asks for a fresh code when the last one you entered on this sign-in is older than 12 hours. The dangerous ones — resuming a paused run or key, turning a pause off, handing a workspace to a new owner, removing or demoting an admin, turning off another person's code, changing your password, approving a computer, making or replacing a key, making a pairing code, and later loosening a limit or changing where stop messages go — ask for one from the last 15 minutes, every time. A key, or the key a pairing code becomes, keeps working after a new password, which is why making one asks.

Straight after signing in with your code, or setting it up, you are inside those 15 minutes: connecting your first computer asks for nothing more.

In the app a small window asks for the code and sends your change again. On a page, you are sent to enter the code and then back to send the change again.

With your phone lost, sign in with one of your recovery codes (Use a recovery code instead, under the code field). Then, on Security, choose Move to a new phone: your password and another recovery code set the code up again on the new phone, and show ten new recovery codes.

With no phone and no recovery codes, write to axigatelabs@gmail.com from your account's own address. We check it is you, turn the code off, and email you; your password alone signs you in, and you set a new code up before your next change. Your workspace's activity record shows that support did it.

Sign out everywhere, on Security, asks for the code your app shows or a recovery code, then ends every other sign-in to your account and keeps the one you are using. Choosing a new password does the same, and never turns your code off.

• Make new recovery codes on Security when you are down to a few: the Needs a look list says so at three or fewer.
• The setup key and the recovery codes are yours alone. The service keeps the key sealed and only scrambled copies of the recovery codes, so nobody can read them back, us included.