Two-step sign-in protects your Tandem App account even if someone learns your password. After entering your password, you also enter a six-digit code from an authenticator app on your phone, so a stolen password on its own isn't enough. It's optional for members and guests, and required for owners and admins before they can open the admin pages. This guide shows how to set it up and what to do if you lose your phone.

What you need

An authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator, 1Password or Authy. Install one first if you don't have one. No text messages are involved.

Setting it up

  1. Click your name at the bottom of the sidebar to open My account, and go to Two-step sign-in.
  2. Enter your password under Password, to start and click Set up two-step sign-in.
  3. Open your authenticator app, add a new account and scan the code shown on the page. If you can't scan it, choose to enter a key by hand in the app and type the key shown under Can't scan?
  4. The app now shows a six-digit code that changes every few seconds. Type the current one into the box and click Turn on.
  5. Your recovery codes are shown. Save them somewhere safe, such as your password manager or a printed copy kept securely. They are shown only this once.

The section now shows On, along with how many unused recovery codes you have left. If you change your mind part-way through, enter your password under Password, to cancel setup.

Signing in from now on

  1. Enter your email and password as usual.
  2. When asked for a Code, open your authenticator app and type the current six-digit code.
  3. Click Sign in.

If you lose your phone

  • Use a recovery code. On the code screen, type one of your recovery codes instead. Each one works once.
  • Get new recovery codes once you're signed in: enter your password under Password, to get new recovery codes and click New recovery codes. The old ones stop working.
  • Ask an admin. If you have no recovery codes left, an owner or admin can reset your two-step sign-in from the admin pages (Roles and access dates, then Reset 2-step). You can then sign in with just your password and set it up again on your new phone.

Moving to a new phone is easier while you still have the old one: many authenticator apps can transfer accounts, or you can turn two-step sign-in off and set it up again.

Owners and admins

Owners and admins hold the keys to everyone's access, so they must have two-step sign-in switched on before they can open the Admin dashboard, the admin pages for invitations, roles and the audit log, or Apps and workflows. Until then, those pages send them to My account to set it up. Admins can see who has it switched on in the 2-step column of Roles and access dates.

Turning it off

Enter your password under Password, to turn it off and click Turn off. If you're an owner or admin, you'll lose access to the admin pages until you turn it on again.

Other good habits

  • Use a password of at least 10 characters that you don't use anywhere else. Change it under Password in My account; changing it signs you out on your other devices.
  • Revoke API tokens you no longer use. See using the REST API.

For what each role can do, see roles and permissions explained.