Skip to main content
Two-factor authentication (2FA) means signing in needs two things: your password, and a six-digit code from an app on your phone. If someone learns your password, that alone is not enough to get in. CaptrID uses TOTP — the standard behind Google Authenticator, Microsoft Authenticator, 1Password, Authy and most password managers. Any of them will work; there is nothing CaptrID-specific to install.
2FA is optional for organisation admins, coordinators and capturers. It is required for CaptrID platform administrators.If you manage a roster of children’s photographs, turning it on is a sensible five minutes.

​
Setting it up

  1. Open your account settings and choose Set up two-factor authentication
  2. A QR code appears — scan it with your authenticator app
  3. The app starts producing a six-digit code that changes every 30 seconds
  4. Enter the current code to confirm the pairing
That is it. The next time you sign in, you will be asked for a code after your password.
If you cannot scan the QR code — you are on the same device as the app, for instance — most authenticator apps let you enter the setup key manually instead.

​
Signing in afterwards

Enter your email and password as usual, then enter the six-digit code from your authenticator. Codes rotate every 30 seconds. If one is rejected, wait for the next code rather than retrying the same one — the most common cause is a code that expired between reading it and typing it.

​
Turning it off

You can remove your own authenticator from account settings. You will be asked to confirm with a current code first, so someone who has walked up to an unlocked laptop cannot quietly switch it off.

​
If you lose your phone

This is the part to think about before it happens, because there is no self-service recovery. If you no longer have the device with your authenticator on it, you cannot complete sign-in and you cannot remove the factor yourself — removing it requires a valid code, which is exactly what you have lost. Contact support and we will reset it after verifying who you are. If you are the only organisation admin, this is the difference between a ten-minute interruption and being locked out of your own organisation, so it is worth doing one of these first:
  • Use an authenticator that syncs across devices or backs up to your account — 1Password, Authy and Microsoft Authenticator all do
  • Add a second organisation admin, so somebody else can always get in
An authenticator app tied to a single phone, with no backup, and no second admin on the organisation, is a single point of failure. It is the most common way people lock themselves out.

​
What 2FA does not cover

  • The mobile capture app. Capturers signing in on a phone are not challenged for a code.
  • Public pages. Profile pages and verification pages have no login at all — they are protected by having an unguessable link, not by a password.

Managing Your Account

Password, email address and profile settings

Inviting Team Members

Roles, and adding a second admin

Audit Logs

Seeing who did what, and when

Support

Resetting a lost authenticator