Two-factor authentication and sessions

Turn on two-factor authentication

CookieBeam supports two-factor authentication (2FA) with an authenticator app that shows 6-digit codes.

1. Open Account settings and select the Security tab.
2. Under Two-factor authentication, select Set up two-factor authentication and enter your current password. If you sign in with Google and have no password, you may be asked to sign in again first.
3. Scan the QR code with your authenticator app. If you cannot scan it, enter the key shown below the code.
4. Enter the 6-digit code from the app and select Verify and enable.
5. Save the recovery codes. Download them or store them in a password manager, then select I have saved these codes.

Each recovery code works once, in place of an app code, if you lose your phone. The Security tab shows how many are left. Select Regenerate recovery codes to replace them all.

To turn 2FA off, select Disable two-factor authentication and confirm with your password and an app or recovery code. If one of your teams requires 2FA, you will be asked to set it up again.

Require two-factor authentication for the team

Owners and admins can make 2FA mandatory for everyone on the team.

1. Open Team.
2. Under Require two-factor authentication, turn on Require 2FA for all members.

The card shows how many members have 2FA enabled. Members without it are taken to the Security tab on their next visit and cannot use the dashboard until they set it up. The requirement can take up to 15 minutes to reach someone who is already signed in.

Members who sign in through your team's single sign-on are not asked for CookieBeam 2FA. Your identity provider handles the second factor for them.

Change your password or email address

Both are on Account settings:

• Change Password is on the Security tab. Enter your current password and the new one twice.
• To change your email address, edit it on the Business Profile tab and confirm with your current password. CookieBeam sends a verification link to the new address, and the change takes effect when you open it. You can cancel a pending change.

Active sessions

Go to /dashboard/settings/sessions in the dashboard to see where you are signed in. The page is not in the sidebar.

• Active sessions lists your devices with when they signed in, their last activity and when they expire.
• Sign out this device ends one session. Sign out every device ends all of them, including devices that signed in before session tracking was introduced and are not listed.

Team session policy

The team owner can limit how long a session stays valid for this team. On the same sessions page:

1. Under Team session policy, set Maximum lifetime (minutes).
2. Optionally set Idle timeout (minutes). Leave it blank to turn the idle timeout off.
3. Select Save session policy.

Team sessions lists members' sessions in this team. Select Revoke team access to sign a member's session out of the team.

If your access to a team has expired or been revoked, the same page lets you sign in again or switch to another team.

Related

• Single sign-on and SCIM
• Team members and roles