Signing in securely

Two-factor authentication

With two-factor authentication on, you sign in with your password and a code from an authenticator app on your phone. Someone who finds out your password still can't get in. Anyone on the account can turn it on for themselves. You don't need to be an owner or an admin.

Set it up from your profile. You'll be asked to confirm your password, and then you'll see a QR code to scan with an authenticator app such as Google Authenticator, 1Password or Authy. Any standard authenticator app works. After scanning, you need to type in a code the app shows you. Two-factor doesn't switch on until you do. That way you know your app is set up properly before you need it to sign in.

As soon as you've confirmed it, you'll see a set of recovery codes. Each one can be used once to sign in instead of a code from your phone. They're for when your phone is lost, stolen, wiped or just not with you. You'll only see them once, so write them down or save them somewhere other than the phone your authenticator app is on. If they're only on that phone, they won't help you when the phone is gone.

If you lose your phone and your recovery codes, you won't be able to get past the code prompt yourself. Get in touch and one of our team will help you back in.

Passkeys

A passkey lets you sign in with your fingerprint, your face or your device's PIN, instead of typing a password. Your device creates and keeps the passkey, and there's no shared secret stored on a server for anyone to steal. A fake sign-in page can't trick you into handing it over, either.

Add a passkey from your profile, in the same place as two-factor. You'll confirm your password once, and then your device will ask for your fingerprint, face or PIN.

A passkey replaces your password. It isn't a second check on top of it. On the device it's set up on, it takes the place of the password step. That matters if your company requires two-factor authentication (see the next section), because signing in with a passkey doesn't count. Two-factor means a password plus a code, and a passkey is neither. If your company has made two-factor compulsory for your role, you'll still need an authenticator app set up, even if you have a passkey too.

Requiring two-factor for your whole company

Two-factor authentication is optional to start with. Anyone can turn it on for themselves, and nobody has to. An owner can change that under Settings → Your company, in the Two-factor authentication card. There are three choices:

• Optional. The default. Anyone can still turn it on for themselves.
• Required for owners and admins. Technicians aren't affected, and can still turn it on if they want to.
• Required for everyone. Everyone on the account, technicians included, has to set it up before they can use the site.

This setting only applies to signing in on the website. It doesn't affect the mobile app, which signs each person in with their own one-time code, or the links you send customers to track their jobs. The app doesn't use a password, so there's nothing for a second factor to add to. To see what controls who can use the app, read signing in on your phone.

Before you save, the screen tells you how many people the option you've picked would affect. That's anyone in a covered role who hasn't set up two-factor yet, and if there are only a few, it names them. So you'll know exactly who it affects before you commit. Saving doesn't sign anyone out.

The next time someone affected opens the site, they're taken to a setup screen, and they can't use the rest of WorkOrders until they've finished it. They can always reach what they need to fix it, though. Their own profile (where two-factor is set up) stays open, and so does billing for an owner.

Other things on your profile

Changing your password asks for your current one first. It doesn't sign you out anywhere else. If you want to do that too, use the section below.

Where you're signed in lists every device and browser you're signed in on, such as a laptop at the office, a phone, or a browser you forgot you'd left signed in. Each one has enough detail for you to recognise it, and the one you're using now is marked. You can sign out of any one of them, or enter your password to sign out everywhere else at once. Do this whenever a device you've signed in on is lost, sold or handed on.

Email verification

WorkOrders asks you to verify your email address, and it's one of the steps on the getting-started checklist, but you don't have to. Everything works the same whether your address is verified or not.

Questions people actually ask