A second code after your password
Two-factor authentication asks for a code from your phone after your password. A stolen password alone then no longer opens your Opensolr account.
It is required on every Opensolr account. Until you turn on an authenticator app or SMS codes, signing in takes you to the two-factor page, and the rest of your account opens once one of them is on. The public pages of the site, and API calls made with your email and API key, are not affected.
Open Account › TFA. The page has three parts: Authenticator app, SMS codes and Recovery codes.
Authenticator app
- Click Set up authenticator app.
- Scan the QR code with your app. If you cannot scan it, type the key shown under it (Copy key helps).
- Enter the code the app shows and click Turn on.
The app shows a new 6-digit code every 30 seconds and works without signal. Any app with time-based codes (TOTP) works, such as Proton Authenticator or Google Authenticator. The page lists a few under Which app should I use?
SMS codes
- Under SMS codes, pick your country and type your phone number.
- Click Turn on SMS codes.
Codes from the Authy app on that number are accepted too. Use a number you always have with you: a wrong number can lock you out. A phone number can be linked to one Opensolr account only.
Recovery codes
When you turn on the authenticator app or SMS codes, Opensolr creates 10 recovery codes. Each one works once, instead of a code from your phone.
- Save them right away with Copy or Download .txt, then click I saved them. You will not see them again.
- Create new recovery codes any time. The old ones stop working.
Signing in
- Sign in with your email and password, as always.
- Enter the code from your app, or the SMS code, and click Verify. With SMS codes on, Send SMS code sends you one.
Lost your phone? Click Use a recovery code. No recovery codes left? Write to support@opensolr.com from the email address of your account.
Turn it off
Click Remove authenticator app or Remove SMS codes, then confirm with a current code or a recovery code.
Two-factor authentication is required, so removing your last method takes you back to the two-factor page: the rest of your account opens again once one method is on.
Who it applies to
- Everyone who signs in to opensolr.com, on every plan.
- Team members turn it on for their own account. Access to the account they work in opens once theirs is on.
- Signing in to the Opensolr apps on a phone asks for it too, because the apps sign you in through opensolr.com.
- API calls made with your email and an API key are not affected. To protect those, see a new master API key and scoped keys.