Two-Factor Authentication
Two-factor authentication (2FA) in Hi.Events adds a second step when you sign in: after your password, you enter a 6-digit code from an authenticator app on your phone. Someone who learns your password still can’t get into your account without your phone.
2FA is set on your own profile, so it protects every Hi.Events account you belong to.
How to Get There
- Click your profile icon and choose My Profile
- Click Security in the left menu (under Personal)
The Two-factor authentication row shows whether it’s On or Off.
Turning It On
- Click Turn on
- Confirm it’s you by entering your Current password and clicking Continue. If you sign in with Google, Microsoft or your company’s single sign-on and don’t have a password, you’re asked to sign in again with that instead
- Install an authenticator app if you don’t have one. Any app that supports time-based codes (TOTP) works. Hi.Events suggests Ente Auth (marked Recommended) or Google Authenticator
- Scan the QR code with the app. On a phone, tap On your phone? Open in authenticator app to add it directly. If you can’t scan it, click Can’t scan it? Enter a setup key instead and type the key into the app
- Click I’ve added it, continue
- Enter the 6-digit code the app shows and click Verify and turn on
- Save your recovery codes (see below), tick I have saved my recovery codes somewhere safe and click Done
You’ll get an email confirming 2FA is on.
Signing In
Sign in as usual. Hi.Events then asks for the 6-digit code from your authenticator app. Codes change every 30 seconds, so enter the one currently showing.
After 10 wrong codes, you have to wait 15 minutes before you can try again.
Trusted Devices
Tick Trust this device for 30 days when you enter your code, and that browser won’t ask for a code again for 30 days. Only do this on your own computer or phone, never a shared one.
If you own an account that requires single sign-on, you’re asked for a code every time you sign in with your password, even on a trusted device.
The Trusted devices row on the Security page lists every browser you’ve trusted, with when it was last used. Click the × (Stop trusting this device) to remove one, or click Remove all if you think a device has been lost or stolen. Each removed device asks for a code at its next sign-in. Changing your password also removes all trusted devices.
Recovery Codes
When you turn on 2FA you get 10 recovery codes. Each one signs you in once if you can’t use your authenticator app, for example if you’ve lost your phone. You only see them once, so Download, Print or Copy all and keep them in a password manager or somewhere safe.
To use one, click Use a recovery code instead on the sign-in screen and enter it in place of the 6-digit code. You’ll get an email each time a recovery code is used, so you’ll know if someone else uses one.
The Recovery codes row on the Security page shows how many you have left, and warns you when you’re down to three or fewer. To get a fresh set, click Generate new codes, enter a code from your authenticator app and click Generate new codes again. The new set replaces the old one, and your old codes stop working straight away.
Switching to a New Phone
Turn 2FA off, then on again, and scan the new QR code with the app on your new phone. If you no longer have the old phone, sign in with a recovery code first.
If your account requires 2FA you can’t turn it off yourself. Move your codes with your authenticator app’s own backup or transfer feature, or ask an admin to reset your 2FA (see below) and set it up again on the new phone.
Turning It Off
- Go to My Profile → Security
- Click Turn off next to Turn off two-factor authentication
- Confirm it’s you with your Current password (or by signing in again if you don’t have one), and enter a code from your authenticator app. Click Use a recovery code instead if you don’t have the app
- Click Turn off two-factor authentication
Your recovery codes and trusted devices are deleted, and you’ll get an email confirming the change.
You can’t turn it off when an account you belong to requires it. The Turn off button is greyed out and the page names the account that requires it.
If you’re the owner of an account that requires single sign-on, you keep signing in with your password, and 2FA is what protects that sign-in. It stays on and can’t be turned off while single sign-on is required.
Lost Your Phone and Your Recovery Codes
Ask an admin on your Hi.Events account to reset 2FA for you. They do this from Account Settings → Team, using the ⋮ menu next to your name and Reset two-factor. Admins can’t reset it for the account owner, or for anyone who also belongs to another Hi.Events account. In those cases, or if no admin can help, email [email protected] from the address you sign in with. We’ll confirm it’s really you before resetting anything.
After a reset you can sign in with just your password. Turn 2FA back on straight away.
Requiring 2FA for Your Team
Admins can make 2FA mandatory for everyone on the account. Team members who haven’t set it up are asked to do so the next time they use Hi.Events. See Managing Your Team.
Tips
- Save your recovery codes somewhere other than your phone. If you lose the phone, you lose them too
- Choose an authenticator app that backs up your codes, such as Ente Auth (end-to-end encrypted backups) or Google Authenticator (optional cloud sync), so moving to a new phone is easier
- Turn on 2FA for every admin on your account. Only admins can connect and disconnect Stripe accounts, so their accounts are worth protecting most
Last updated