Two-Factor Authentication
Two-factor authentication (2FA) in Hi.Events adds a second step when you sign in: after your password, you enter a 6-digit code from an authenticator app on your phone. Someone who learns your password still can’t get into your account without your phone.
How to Get There
- Click your profile icon and go to My Profile
- Click the Security tab
Turning It On
- Click Turn on two-factor authentication
- Enter your Current password and click Continue
- Install an authenticator app if you don’t have one. Any app that supports time-based codes (TOTP) works, including Ente Auth, Google Authenticator, 1Password and Authy
- Scan the QR code with the app. If you can’t scan it, click Can’t scan it? Enter a setup key instead and type the key into the app. On a phone, Open in authenticator app adds it directly
- Enter the 6-digit code the app shows and click Verify and turn on
- Save your recovery codes (see below), tick I have saved my recovery codes somewhere safe and click Done
You’ll get an email confirming 2FA is on.
Signing In
Sign in with your email and password as usual. Hi.Events then asks for the 6-digit code from your authenticator app. Codes change every 30 seconds, so enter the one currently showing.
After 10 wrong codes in a row, sign-in is locked for 15 minutes.
Trusted Devices
Tick Trust this device for 30 days when you enter your code and that browser won’t ask for a code again for 30 days. Only do this on your own computer or phone, never a shared one.
The Trusted devices list on the Security tab shows every browser you’ve trusted. Remove one you no longer use, or click Remove all if you think a device has been lost or stolen. Changing your password also removes all trusted devices.
Recovery Codes
When you turn on 2FA you get 10 recovery codes. Each one signs you in once if you can’t use your authenticator app, for example if you’ve lost your phone. You only see them once, so Download, Print or Copy all and keep them in a password manager or somewhere safe.
To use one, click Use a recovery code on the sign-in screen and enter it instead of the 6-digit code. You’ll get an email each time a recovery code is used, so you’ll know if someone else uses one.
The Security tab shows how many codes you have left. When you’re running low, click Generate new codes. This replaces the whole set, and your old codes stop working straight away.
Switching to a New Phone
Turn 2FA off, then on again, and scan the new QR code with the app on your new phone. If you no longer have the old phone, sign in with a recovery code first.
If your account requires 2FA you can’t turn it off yourself. Move your codes with your authenticator app’s own backup or transfer feature, or ask an admin to reset your 2FA (see below) and set it up again on the new phone.
Turning It Off
- Go to My Profile → Security
- Click Turn off
- Enter your Current password and a code from your authenticator app (or a recovery code)
- Click Turn off two-factor authentication
Your recovery codes and trusted devices are deleted, and you’ll get an email confirming the change.
If an account you belong to requires 2FA, the Turn off button is disabled and the Security tab names the account that requires it.
Lost Your Phone and Your Recovery Codes
Ask an Admin on your Hi.Events account to reset 2FA for you from Account Settings → Users. If you’re the account owner, or no admin can help, email [email protected] from the address you sign in with. We’ll confirm it’s really you before resetting anything.
After a reset you can sign in with just your password. Turn 2FA back on straight away.
Requiring 2FA for Your Team
Admins can make 2FA mandatory for everyone on the account. Team members who haven’t set it up are asked to do so the next time they use Hi.Events. See Managing Your Team.
Tips
- Save your recovery codes somewhere other than your phone. If you lose the phone, you lose them too
- Choose an authenticator app with encrypted backup (Ente Auth, 1Password) so a new phone picks up your codes automatically
- Turn on 2FA for every admin on your account. Admins can connect Stripe and change payout details, so their accounts are worth protecting most
Last updated