Two-Factor Authentication
With two-factor authentication, logging in asks for a second factor after your password (or after logging in with Google or Discord). A leaked password alone is then not enough to get into your account.
Codecks supports two kinds of second factors:
- Security keys: a passkey in your password manager or on your phone, or a hardware key such as a YubiKey
- Authenticator app: an app on your phone or in your password manager that shows a new 6-digit code every 30 seconds
You can use either or both. Two-factor authentication is on as soon as you have one of them, and off once you remove the last one.
Everything below happens in your profile under Security. Open Mission Control (the joystick icon in the top left), select your profile picture or name, then open the Security tab.
Turning It On
Add a security key or set up an authenticator app, as described below. For your first factor, Codecks then:
- shows your recovery codes, once
- logs you out on every other device, so each one has to log in again with the second factor
Adding a second factor next to one you already have does neither.
Codecks sends an email to your primary address whenever a factor is added, replaced or removed, when new recovery codes are generated, and when two-factor authentication is turned on or off. If you didn’t make the change, log in, use “Invalidate all open sessions” on the Security tab and review your factors.
Security Keys and Passkeys
Adding a Security Key
- Click “Add security key” in the “Two-factor authentication” section
- Click “Continue”. Your browser asks you to touch a hardware key, or to create a passkey on this device or in your password manager
- Give the key a name, so you can tell your keys apart, and click “Add security key”
Codecks suggests a name based on the key, such as the name of your password manager. You can add as many keys as you like. Adding a second one, for example a hardware key you keep in a drawer, is a good backup.
Each key is listed with its name, when it was created and when it was last used. A key is labeled either:
- Synced passkey: stored in a password manager or your phone’s keychain and synced across your devices
- Hardware key: stored on a single device, such as a YubiKey, that has to be at hand when you log in
Renaming and Removing a Key
Click the pencil icon next to a key to rename it, or the trash icon to remove it.
Removing a key does not log out the devices where you logged in with it. If the key was lost or stolen, also use “Invalidate all open sessions” below.
Authenticator App
Any app that supports time-based codes (TOTP) works, such as Google Authenticator, Microsoft Authenticator, or the one built into your password manager. You can have one authenticator app per account.
Setting Up an App
- Click “Set up authenticator app” in the “Authenticator app” section
- Scan the QR code with your app. If you can’t scan it, click “Can’t scan?” and enter the key shown there in your app as a time-based key
- Enter the 6-digit code your app now shows and click “Set up app”
The section then shows when the app was set up and when a code from it was last used.
Replacing Your App
Moving to a new phone or another app? Click “Replace” and go through the same steps with the new app. Your current app keeps working until you confirm the new one with its code. After that, codes from the old app are no longer accepted.
Removing Your App
Click the trash icon next to the app. If it is your last factor, two-factor authentication is turned off and your recovery codes are deleted.
Removing the app does not log out the devices where you logged in with a code from it. If your phone was lost or stolen, also use “Invalidate all open sessions” below.
Recovery Codes
Recovery codes get you in when your security key or authenticator app is not at hand. You get 8 of them when you turn on two-factor authentication:
- They are shown only once. Save them somewhere safe, such as your password manager, and not only on the phone that runs your authenticator app
- Each code works once. Codecks sends an email to your primary address whenever one is used to log in
- The “Recovery codes” section shows how many unused codes you have left, and warns you when you are running low
Click “Generate new codes” to get a fresh set of 8. Your old codes, including the unused ones, stop working.
Logging In
After your password, or after logging in with Google or Discord, Codecks asks for your second factor:
- With only security keys, your browser asks for one right away. If that fails or you cancel it, click “Try again”
- With only an authenticator app, enter the current code. It logs you in as soon as all 6 digits are in, so a password manager filling the code logs you straight in
- With both, choose between “Use your security key” and “Enter code from authenticator app”. “Choose another method” takes you back to that choice
Each step also offers “Use a recovery code”.
A code from your authenticator app works once. If it was rejected, wait for the next one. After several wrong codes in a row, codes from the app are refused for a while, and each further round of wrong codes makes the wait longer. Security keys and recovery codes keep working in the meantime. Codecks also sends you an email about it, since whoever entered those codes likely knows your password. If that wasn’t you, change your password and log out of all open sessions.
Lost Your Key or Phone?
- Log in with a recovery code, or with another factor you still have
- On the Security tab, remove the lost key or authenticator app
- Use “Invalidate all open sessions”, so a device that is logged in with the lost factor is logged out too
- Add a new security key or set up your authenticator app again
If you used a recovery code, consider generating a new set.