Signing in, and getting back in

Every account needs two things to sign in: a password and a second factor. This page is about the second one, and about the day something that normally works does not.

The second factor is not optional

A password on its own does not sign anybody in, and there is no setting that turns that off — for our staff and for yours. After the password is accepted you are asked for one of two things, and the account chooses which:

Factor	What it is, and when to prefer it
A code by email the default	Six digits sent to the address on the account, valid for ten minutes. Nothing to install and nothing to set up, which is why it is what you get without doing anything. It depends on your email working.
An authenticator app	Six digits generated on your phone by 1Password, Aegis, Authy, Google Authenticator, Microsoft Authenticator or any other TOTP app (the open standard, RFC 6238 — nothing here depends on any one company). No network, no delivery, nothing to wait for. Set it up from your profile and it replaces the emailed code — you will not be asked for both.

Operator accounts at DoConure are the one exception: they always get the emailed code, and an authenticator app is a third step added on top rather than a replacement. That is a rule about our own staff, not about yours.

Every way in goes through this, including the ones that look like shortcuts:

Google proves who you are, as a password does — it is the first step, never the whole sign-in.
There are no password-less accounts. Every account has a password and a second factor (decided 2026-10-08). An account that used to sign in with an emailed link is sent, the next time it signs in, a link to choose a password; from then on it signs in like every other account, and keeps the second factor it had — the authenticator app if it set one up, the emailed code otherwise.
A password reset or an invitation link lets you choose a password and then takes you to the sign-in page. It never signs you in by itself.
A new account is signed in once, straight after the emailed verification link you clicked to create it. Every sign-in after that asks for the second factor.
An API key is not a sign-in and is not affected: it is for programs, not for people.

Setting up the authenticator app

Open your profile and, under Two-factor authentication, press Set up the app.
Scan the QR code with the app, or tap the link on a phone, or type the key in by hand. The QR code is drawn on the page itself; nothing is fetched from anybody else.
Type the six digits the app now shows. Nothing changes until that code is accepted, so a mistake cannot lock you out.
You are shown ten recovery codes, once. Keep them somewhere that is not your phone.

To change phone, turn the app off from the same card (your password is asked for) and set it up again. Turning it off sends you back to the emailed code; it never leaves an account with nothing. Changing how you sign in ends every other session you had open: you are signed out of the other browsers and devices.

I lost my phone

Sign in with your password and type a recovery code in the box where the app code goes. It works once.
No recovery code left? On that same page press I lost my authenticator — email me a code instead. A code is sent to your address and you sign in with it. This is a button, never a link in an email, and it is limited and recorded like every other code. It is not offered to operator accounts, whose app is an extra step: they use a recovery code or ask the platform owner.
Once in, set the app up again on the new phone and make a new set of recovery codes.

Sign-in is rate-limited in ways that never reveal whether an address has an account: the same message is shown for an address that does not exist as for one that is locked.

Five wrong answers lock an account for 15 minutes.
Too many failures from one address, against too many different accounts from one address, or from one network, are refused for the same 15 minutes — that is what stops one password being tried against thousands of accounts.
Sign-in codes by email are limited per account per hour, and codes by text per account and per address per day. Past the limit the code you were already sent stays valid for its ten minutes.

The limits are settings of the platform (Security section of the operator settings), not hard-coded numbers.

Passwords expire

A password is good for 90 days by default. The number is set by whoever administers the platform and can be any value, or nothing at all.

When it runs out, signing in does not fail — you are sent a link to choose a new password. A warning appears a week before, so in the ordinary case you change it when it suits you rather than when you are trying to get something else done.

An account can also be given an explicit expiry date, which overrides the rolling window in either direction. That is for cases the window cannot express: a contractor whose access ends on a date, or a password that has to change by Friday because somebody read it over a shoulder.

Recovery codes — the day your email stops working

This is the part worth reading before you need it.

Your email address is doing three jobs at once. It is how the account is named, it is where the second factor is sent, and it is how a forgotten password is reset. They all rely on the same mailbox, so if that mailbox stops working, all three stop together — and there is no partial state. You cannot sign in, and you cannot recover the thing you would need in order to sign in.

It happens for ordinary reasons: somebody leaves a company and IT closes the address, a domain moves provider, a mailbox fills up, an account was created against a personal address that has since been abandoned. Password expiry makes it a question of when rather than if, because the reset link is sent to that same address.

Recovery codes are the answer, and they are the only one that needs nothing to work. No mailbox. No phone. No network. No third party. Ten single-use codes, printed once, that each stand in for the second factor.

Making a set

Open your profile from the menu at the bottom of the side bar.
Find Recovery codes and enter your password. It is asked for because an unlocked screen must not be enough to mint a credential that skips the second factor.
The codes are shown once. Copy them then, because only their hashes are kept — nobody at DoConure can read them back to you. Not support, not an administrator, not whoever holds the database.

Making a new set replaces the old one. A set somebody printed and lost is worse than no set at all, because they believe they have one. Making a new set also ends every other session you had open, the same as when a coordinator suspends somebody or changes how they sign in.

Using one

Sign in with your password as usual. When you are asked for the code that would have been emailed, type a recovery code instead. It works once and is then gone; the others keep working.

Where to keep them

Somewhere that is not your inbox and not the phone with the authenticator app on it — those are the two things that might be the thing that is unavailable. Printed, in a drawer, is a perfectly good answer. A password manager on a different device is another.

What we cannot do for you

We cannot read your recovery codes back to you, and we cannot move an account to a different email address on a support call. Both would mean that a convincing phone call is enough to take over an account, which is a worse failure than the one it would solve.

So the honest advice is short: create a set of recovery codes now, while everything works. It takes a minute and it is the only thing that helps on the day nothing else does.