Two-factor authentication
With two-factor authentication, you sign in with your password and a 6-digit code from an app on your phone. Someone who learns your password still cannot get in. Whence uses authenticator apps; it does not send codes by text message or email.
Step 1: Open Security
Go to Settings > Security (1). The Status line says “Off. Your account is protected by your password only.” (2). Click Turn on two-factor authentication (3). It takes about a minute, and you need your phone.
Step 2: Add Whence to your app
Follow the three steps on the screen (1): open your authenticator app and scan the QR code. If you cannot scan, type the key shown under “Can’t scan? Enter this key:”.
Step 3: Enter the code
Type the 6-digit code the app shows under Code from your app (2), then click Verify and turn on (3).
You see “Two-factor authentication is on”, and the status becomes “On, with 1 device.” From then on, each sign-in asks for Enter the 6-digit code. If a code is refused, Whence says “That code did not work. Check the time on your phone and enter the newest code.”
Step 4: Add a backup device
Whence has no backup codes. If your only phone is lost, you cannot sign in with a code. Add a second device right away: another phone, or a password manager that stores codes.
Click Add a backup device and follow the same steps with the second app. With two devices, the page says “You have a backup device. If you lose one, sign in with the other and remove the lost one here.”
Step 5: Require it for your team
The Require it for your team card makes two-factor authentication mandatory for everyone in the workspace. It is enforced by the database, not just the screen: without a code, Whence answers nothing.
Click Require for everyone (1), or Stop requiring to make it optional again. Below, each member is listed with On or Not set up (2).
- Only the owner can change it. Everyone else sees Required or Optional, with “Only the owner of the workspace can change this.”
- The owner must turn it on for themselves first: “Turn it on for yourself first (above). You cannot require what you do not use.”
- Once it is required, members who have not set it up are asked to do so the next time they sign in. People with the Team right see a count such as “2 of 5 members have not set it up yet.”
Remove a device or turn it off
Each device is listed with the date it was added. Click Remove next to it, enter a current 6-digit code, then click Remove device. Removing your last device turns two-factor authentication off: “Two-factor authentication is off”.