Two-factor sign-in
Add a code from an authenticator app to every Milvao sign-in. It's optional for community teams and recommended for anyone who manages members.
Two-factor sign-in protects your account even if someone learns your password. After your password, Milvao asks for a 6-digit code that only your phone can produce. It is optional, and Milvao never makes you set it up before you can sign in. Until it's on, a short reminder appears at the top of the app with Set it up and Set up later (which hides it for 30 days on that browser). We recommend it for everyone who can see member profiles.
You need an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator, 1Password or Authy.
Turn it on
Confirm your email address first: open the link in your sign-up email, or accept your team invite. Until then the set-up is refused, so nobody who used your address before you can lock the account with their phone.
- Click your name at the bottom of the sidebar, then Security and two-factor.
- On the Two-factor sign-in card, enter your Password and click Set up two-factor sign-in.
- Open your authenticator app, add an account, and scan the QR code. Can't scan? Type in the key shown under Can't scan? Key: instead.
- Enter the 6-digit Code your app shows and click Turn on.
- You see Two-factor sign-in is on and a list of backup codes. Click Copy codes and keep them somewhere safe, such as a password manager.
Important
Backup codes are shown only once. If you lose your phone and your backup codes, you can't sign in until Milvao helps you.
Sign in with it
- Sign in with your email and password as usual.
- On the Two-factor sign-in page, enter the 6-digit Code from your app and click Verify.
Use a backup code
If you don't have your phone, click Use a backup code, enter one of your saved codes and click Verify. Each backup code works once. To go back to the app, click Use the authenticator app instead.
Turn it off
- Click your name at the bottom of the sidebar, then Security and two-factor.
- Enter your Password and click Turn off.
Emails about your account
Milvao emails you when two-factor sign-in is turned on or off, when new backup codes are made, and when your password changes. If you didn't make the change, reset your password from Forgot password on the sign-in page and write to hello@milvao.com straight away.
If you reset your password before you ever confirmed your email address, any two-factor set-up on the account is removed, because the reset link proves the inbox is yours. Set it up again afterwards.
For Milvao staff: codes for sensitive actions
Milvao's own staff are asked for a fresh code during sensitive actions in the admin panel, even right after signing in: viewing your workspace as an operator (only while you've granted support access), creating or rotating admin API tokens, changing staff roles, adding an owner to a workspace that already has one, and removing a workspace owner. One code covers those actions for 10 minutes in that browser. Staff can't add themselves to your team: an owner invite or owner removal made by Milvao staff emails every owner of the workspace, so you always know.
Troubleshooting
| What happens | What to do |
|---|---|
| Confirm your email address first when you set it up | Open the link in your sign-up email or accept your team invite, then try again |
| Too many codes tried | Wait 10 minutes. Each account can try a limited number of codes |
| The code doesn't work | Codes change every 30 seconds and depend on your phone's clock. Set the clock to automatic, wait for a fresh code and try again |
| 6 digits under the field | Enter only the 6 numbers, without spaces |
| You got a new phone | Before you switch, sign in on the old phone's app, turn two-factor off and set it up again on the new phone. Some apps can also move accounts between phones |
| You lost your phone | Sign in with a backup code, then turn two-factor off and set it up again on your new phone |
| You lost your phone and your backup codes | Email hello@milvao.com from the address on your account |
Frequently asked questions
Does my whole team have to use it?
No. Each person chooses for their own account, and nobody is blocked from signing in without it.
Can I use SMS codes instead?
No. Milvao uses authenticator apps only, which are safer than SMS.
Something unclear or missing? Tell us