Two-step sign-in

Two-step sign-in adds a second check after your password: a six-digit code from an authenticator app on your phone. The code changes every 30 seconds, so a stolen password alone is not enough to get into your workspace. Zamilo does not send codes by text message or email; they always come from the app.

Which apps work

Any authenticator app that reads a standard QR code and makes time-based codes (often called TOTP) works. For example: Google Authenticator, Microsoft Authenticator, 1Password and Authy. Many password managers have one built in. The app lists the account under Zamilo (or the product name your company chose) with your email address.

Turn it on

1. Click your name at the bottom of the left-hand menu to open My Profile.
2. In the Security box, press Two-Step Sign-In: Off.
3. In your authenticator app, add an account and scan the QR code on the page. Can't scan? Type the key shown under it instead, and choose a time-based code if the app asks.
4. Type the six-digit code the app now shows into Code from your authenticator app and press Turn On.
5. Save your recovery codes (next section), then press I Have Kept Them.

If Zamilo says the code is not right, check that your phone sets its clock automatically, then type the code showing now. A code from just before or after the current 30 seconds is accepted, but each code works only once.

Your recovery codes

When two-step sign-in turns on, Zamilo shows Your Recovery Codes: ten codes that look like abcde-fghjk.

• They are shown only once. Press Copy and keep them in your password manager, or print them. Don't keep them only on the phone that has the app.
• Each code gets you in once, if your phone is not at hand.
• Zamilo keeps only a one-way fingerprint of each code, so nobody, including us, can show them to you again.
• My Profile → Two-Step Sign-In: On shows Recovery codes left.
• For a fresh set, type a current code from the app on that page and press New Recovery Codes. The old codes stop working.

Signing in

1. Sign in at https://app.zamilo.io/login with your email and password.
2. On Enter your code, type the six-digit code from the app and press Sign In. The code must follow the password within five minutes; after that, sign in again.

With a recovery code: on the same page, open Lost your phone?, type one of your recovery codes in the same box and press Sign In. Zamilo tells you how many codes you have left.

Wrong codes count like wrong passwords: five within 15 minutes lock the account for 15 minutes. An administrator can press Unlock on Settings → Users.

Lost or new phone

If you lost your phone

Your recovery codes get you in, one sign-in each. Moving two-step sign-in to a new phone needs a code from the old app, though, so without the old phone you need an administrator:

1. An administrator goes to Settings → Users.
2. On your row they press Reset Two-Step and confirm.
3. You sign in with your password only, then set up the app again on your new phone from My Profile. If your company requires two-step sign-in, Zamilo takes you to the set-up page straight away.

Administrators cannot reset their own two-step sign-in this way; another administrator must do it. Resetting your password does not turn two-step sign-in off.

If you are changing phones

• Before you wipe the old phone, move your accounts with the authenticator app's own transfer or backup feature, if it has one.
• Or, if your company does not require two-step sign-in, turn it off (below) with a code from the old phone, then turn it on again with the new one. You get new recovery codes too.
• Otherwise, ask an administrator to reset it.

When your company requires it

An administrator can require two-step sign-in for everyone on Settings → Security (see Require two-step sign-in for everyone). Once it is required:

• Anyone who has not set it up sees Two-step sign-in is required here. Set it up to carry on. at their next page, and can do nothing else until it is on.
• Nobody can turn their own off. The Turn It Off box is not shown.
• A lost phone is still reset by an administrator, as above.

Turning it off

Only when your company does not require it:

1. Open My Profile and press Two-Step Sign-In: On.
2. Under Turn It Off, type Your password and A code from the app.
3. Press Turn Off Two-Step Sign-In. Signing in needs only your password again.