Your sign-in: password, two-factor and passkeys

What you set under Settings›Security concerns your own sign-in, and every role sees this page. Only the owner also sees the two-factor requirement for everyone there. By the end you will know how to change your password, set up a second factor, manage passkeys and linked Google or Microsoft sign-ins, and sign out devices. Whenever your password, authenticator app, recovery codes or passkeys change, we send you an e-mail.

Change your password

1. Open Settings›Security.
2. In the Change password card, enter your Current password.
3. Enter the new one under New password and Repeat. It needs at least 10 characters and must differ from the current one.
4. Click Change password.

Every other device is signed out; this one stays signed in.

If you only sign in with Google or Microsoft, the card is called Password. Set a password sends you a link to set one.

Two-factor confirmation with an app

You need an authenticator app on your phone. A text message does not count as a second factor.

1. In the Two-factor confirmation card, click Set up 2FA.
2. Scan the QR code with the app, or take the key with Copy key.
3. Enter the Code from the app and click Activate.
4. Your recovery codes now appear: ten codes you see exactly once. Keep them with Copy codes or Save as a file, and keep them somewhere you can reach without this device.
5. Close with I have saved the codes.

Each recovery code works once and stands in for the app if you lose your phone. Generate new recovery codes gives you ten new ones and voids the old set. For that, and for Turn 2FA off, scoco asks for your password and a code from the app or a recovery code.

Whether two-factor confirmation is mandatory for everyone is the owner's decision: see Two-factor confirmation for everyone.

Passkeys

A passkey signs you in with Face ID, your fingerprint or your device PIN, with no password. It also counts as a second factor: when you sign in with a password or with Google or Microsoft, scoco asks for the passkey as well.

1. In the Passkeys card, click Add a passkey.
2. Give it a name if you like, and click Continue.
3. Confirm in your browser's prompt.

If this is your first second factor, scoco then shows recovery codes once, as it does for the app. You can add up to 10 passkeys, rename each with Rename and delete it with Remove. If you remove your only second factor, your recovery codes stop working too.

Adding and removing need a sign-in from the last 15 minutes. Otherwise the card offers Sign in again and brings you back here afterwards. If your browser does not support passkeys, the button is missing and the card says so.

Google or Microsoft

The Sign-in methods card shows the Google and Microsoft accounts you sign in with and offers to link more. If no such sign-in is available, the card is not there. Linking also needs a fresh sign-in. Remove undoes a link, and we confirm it by e-mail. If your account has no password, its last sign-in method cannot be removed. Set a password first.

Sign out devices

The Active sessions card lists the devices you are signed in on, with their last activity and, where known, the IP address. The device you are using shows This device. Sign out ends a single session, and Sign out every other device ends all of them except this one.

Common problems

You have lost the phone with the app. At sign-in, choose Trouble? Use a recovery code and enter one of your codes. Afterwards, generate new codes or set the app up again. If you have no code left, read Lost your second factor.

Your sign-in is too long ago. Please sign in again briefly — you will come back here. Click Sign in again. You return to this page afterwards.

Too many failed attempts. Please try again in 15 minutes, or reset your password. After five wrong passwords in a row, sign-in is locked for 15 minutes. Wait, or use Forgot your password?.

You cannot add another passkey. The limit is 10. Remove one first.