Two-factor authentication

Overview#

Two-factor authentication (2FA) adds a second step to dashboard sign-in: after your password you enter a 6-digit code from an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator, 1Password or Authy. Each user turns it on for their own account under Settings → Security. Your Profile page shows whether it is on.

• Codes are standard time-based one-time passwords (TOTP, RFC 6238): 6 digits, a new code every 30 seconds, SHA-1.
• A code is accepted for the current 30-second period and one period either side, to allow for small clock differences. Each code can be used only once.
• No SMS, phone number or third-party service is involved.
• Two-factor is optional per user. There is no organisation-wide setting that forces users to turn it on; each user chooses it under Settings → Security.

Turning on two-factor#

1. Go to Settings → Security and confirm your current password.
2. In your authenticator app add an account (usually a + button) and scan the QR code shown. If you cannot scan, type the setup key (time-based) instead; it is shown in groups of four characters. The account appears in your app as CentraPoint with your email address.
3. Enter the 6-digit code the app shows and click Turn on two-factor.
4. Save the 10 backup codes that appear, using Copy codes or Download .txt (centrapoint-backup-codes.txt), then click I've saved them. They are shown only once.

Nothing changes for sign-in until the code is confirmed. Cancel abandons the set-up. If you start again, a new setup key is created and the previous QR code stops working.

Signing in#

1. Enter your email and password as usual.
2. If the password is correct and two-factor is on, you are asked for the 6-digit code from your authenticator app. The second step is only shown after the password has been verified.
3. If you do not have your phone, choose Use a backup code and enter one of your backup codes. You can switch back with Use my authenticator app.

A password alone never signs in a user who has two-factor on. If a code is not accepted you can try again with a new code; if the sign-in fails for another reason (for example your password was changed meanwhile), you are sent back to the first step.

Backup codes#

• You get 10 codes when you turn on two-factor.
• Each code is 10 characters shown as two groups of five, e.g. k7m2p-x9qrt, using lower-case letters and digits (without easily confused characters such as 0, 1, i, l and o). Capitals, spaces and dashes are ignored when you type one.
• Each code works once, at sign-in or to turn two-factor off.
• Settings → Security shows how many codes you have left, with a warning when two or fewer remain.
• Codes are stored hashed; CentraPoint cannot show them to you again.

Creating new backup codes#

Under Settings → Security → New backup codes, enter a current code from your authenticator app (a backup code is not accepted here). You get 10 new codes and all your old backup codes stop working.

Turning off two-factor#

Under Settings → Security → Turn off, enter your current password and either a current authenticator code or a backup code. Turning it off deletes your authenticator secret and backup codes; your account is then protected by your password only. You can turn it on again at any time with a new QR code.

Admin reset for locked-out users#

If a user has lost both their authenticator app and their backup codes, a user with the users:write permission (Admin by default) can reset it:

1. Go to Settings → Users. Users with two-factor on show 2FA on in the Last login column.
2. Click Reset 2FA and confirm.

The user's two-factor is turned off and their backup codes are deleted. They then sign in with their password alone and can set it up again under Settings → Security.

• You cannot reset your own two-factor this way; turn it off under Settings → Security instead.
• A platform administrator's two-factor can only be reset by a platform administrator.
• As with editing users, you can only reset someone whose permissions are all within your own ("You cannot manage a user with more permissions than you"). Platform administrators are exempt.

SMS (phone) two-factor has been replaced#

Earlier versions of CentraPoint offered two-factor by SMS code to a phone number. That method has been removed and replaced by authenticator apps. When the change was deployed:

• all existing SMS enrolments were cleared, and the stored phone numbers used for two-factor were removed;
• users who had SMS two-factor now sign in with their password only until they set up an authenticator app under Settings → Security.

Rate limits#

Limits use fixed time windows, so access returns when the window ends. There is no permanent account lockout; failed code attempts are recorded in the audit log.

Audit log entries#

The audit log is under Settings → Audit log on plans that include it.

API keys are not affected#

Two-factor applies to signing in to the dashboard only. Requests to the REST API are authenticated with API keys and are not asked for a second factor; see Authentication. Keep API keys secret and revoke any that may have been exposed.