Two-factor authentication

For: Everyone Where to find it: Click your avatar (bottom of the sidebar) → Settings → Two-factor auth

Two-factor authentication adds a second step to signing in, so a stolen password is not enough on its own to get into your account. Tourium supports two kinds of second step: an authenticator app that shows six-digit codes, and passkeys, which let you confirm it's you with your fingerprint, face or device PIN.

The top of the page tells you where you stand — Two-factor authentication is on or Two-factor authentication is off — and when it was switched on.

Confirm it's you first

Changing how you sign in is sensitive, so Tourium asks you to prove it's you before it lets you. Until you have, the page shows Confirm it's you to make changes with a Confirm it's you button, and the buttons for adding, removing and regenerating are switched off.

On the Confirm it's you screen, use whichever proof you have:

Confirm with a passkey — if you have a passkey, this is offered first.
Confirm with password — type your password.
Confirm with code — enter the Code from your authenticator app.

Use the links underneath (Use a passkey instead, Use an authenticator code instead, Use your password instead) to switch between them. If you signed up with Google or Microsoft and never set a password, choose the link "Email me a link to set one", or confirm with a passkey or authenticator code. Once you've confirmed, you're taken back to where you were, and you can make changes for the next 15 minutes before Tourium asks again.

This applies to adding or removing an authenticator app or passkey, turning two-factor off, generating new recovery codes, and resetting a team member's two-factor.

Common tasks

Set up an authenticator app

Open Settings → Two-factor auth.
Under Authenticator app, click Set up an authenticator app.
Scan the QR code with Google Authenticator, Authy, 1Password or any other authenticator app. If you can't scan it, type the key shown under Can't scan it? Enter this key by hand into the app instead.
Enter the Six-digit code the app shows, and click Turn on two-factor (or Add authenticator app, if two-factor is already on because you have a passkey).
Tourium shows your recovery codes. Save them somewhere safe (see below), then confirm with I've saved these.

From now on, after you enter your password Tourium asks for the current six-digit code from your app.

Save your recovery codes

Recovery codes are the only way back into your account if you lose the phone or app that makes your codes. Each code works once.

Click Copy and paste them into a password manager or another safe place.
The page shows how many codes you have left.
To get a fresh set, click Generate new codes and confirm. Your old codes stop working immediately, so save the new ones straight away.

To use one, choose Use a recovery code instead on the sign-in code screen and type one of your saved codes.

Add a passkey

You can keep up to 10 passkeys. A passkey is stored on your device or in your password manager. It can't be phished, and it works either as your second step after your password, or on its own so you can sign in without a password at all.

Under Passkeys, click Add a passkey.
Follow your browser or device prompt (fingerprint, face or PIN).

Each passkey is listed with the date it was added and when it was last used. Use the menu next to a passkey to:

Rename passkey — give it a name you'll recognise, such as "Work laptop".
Remove passkey — you can no longer sign in with it. Remove it from your device or password manager too.

If your browser can't use passkeys, the page tells you so ("This browser does not support passkeys").

On the login page, click Sign in with a passkey and confirm on your device. You're signed straight in — no password or code needed. Your browser may also offer your passkey when you click into the email field.

If you sign in with your password instead and have a passkey set up, the second-step screen offers Use your passkey.

Remove your authenticator app or turn two-factor off

Remove authenticator app stops codes from the app working. If you still have passkeys, they keep protecting your account.
Turn off two-factor switches the second step off completely, leaving your account protected by your password alone. You can turn it back on at any time.

If any organisation you belong to requires two-factor authentication, you'll see "Your organisation requires two-factor authentication, so it cannot be turned off". You can still swap methods — for example remove your authenticator app once you have a passkey — but you can't remove your last remaining one; Tourium tells you to add a passkey or an authenticator app before removing it.

Avoid being locked out

If you have only one second step, the page shows Avoid being locked out with an Add a passkey button. With a single method, losing that phone or device means relying on a recovery code to get back in, so add a second method now.

Whenever something about how you sign in changes, Tourium emails the address on your account with the subject "Security alert", saying what changed, when, and from which IP address and browser. It is sent for: an authenticator app or passkey being added or removed, two-factor being turned off or reset by an organisation owner, new recovery codes being generated, a recovery code being used to sign in, and your password or email address being changed. If it wasn't you, use Review security settings in the email, remove anything you don't recognise and change your password.

The login page marks the method you used last time on this browser — a Google, LinkedIn, Facebook or Microsoft button, or Sign in with a passkey — with a Last used label. It's a handy reminder if you can't remember which way your account was set up.

Requiring two-factor for your whole organisation

An organisation's Owner can make two-factor authentication compulsory for everyone.

Go to your organisation name → Details.
Switch on Require two-factor authentication.

Once it's on, members who haven't set up two-factor are asked to do it the next time they use Tourium, before they can continue. They can set up a passkey or an authenticator app. When it's off, members can still turn two-factor on for themselves from their own settings.

You can see who has it set up on the Team page — the 2FA Status column shows 2FA or No 2FA for each member.

If a team member is locked out

If someone has lost their authenticator, their passkeys and their recovery codes, a team manager can reset them:

Go to your organisation name → Team.
Open the menu on that person's row and choose Reset two-factor.
Confirm.

Their authenticator app, passkeys and recovery codes stop working, and they'll be asked to set two-factor up again the next time they sign in. They're emailed a security alert too. Resetting needs the Manage organisation permission as well as access to the Team page, and you'll be asked to confirm it's you first.

Tips

Set up two methods — for example an authenticator app and a passkey — so losing one device doesn't lock you out.
Store your recovery codes somewhere other than the phone that runs your authenticator app.
Adding a passkey to a password manager that syncs across your devices means it's available everywhere you sign in.