Two-factor authentication

Two places, two settings

Your Arty account is the one you use on artypanel.com. It holds your wallet, your invoices and your panels. Its protection is called two-step login and you manage it in Settings.

Your panel has its own sign-in for you as the owner and for each staff member you add. For each person you choose a sign-in check: an email code or an authenticator app. You choose it in your Arty account, on the Staff page of the panel and in the panel Settings.

The two settings do not depend on each other. Turn on both: a leaked password should not be enough to reach your money or your customers.

Turn on two-step login for your account

Two-step login adds a six-digit code from an authenticator app on your phone to your password. Any authenticator app that makes time-based six-digit codes works.

• Confirm your email address first. The Turn on two-step login button appears only when your address is confirmed. If it is not, the page shows a button that takes you to the confirmation step.
• Open Settings and choose Two-step login, then Turn on two-step login. You may be asked to confirm your password first (see the confirm-again step below).
• Scan the QR code with your authenticator app. If you cannot scan, enter the key shown below the code by hand.
• Type the six digits the app shows now and press Turn on. If the code is not right, wait for a new one and try again.
• Save your recovery codes. They are shown once, right after this step.

When two-step login is on, the page shows On and how many recovery codes you have left. You also get a security notice by email.

Recovery codes

You get 10 recovery codes when you turn two-step login on. Each one works once, in place of an authenticator code, if you lose your phone.

• Copy them when they are shown. Arty stores only a scrambled form, so they cannot be shown again.
• Keep them somewhere other than the phone that holds the app.
• A code looks like ABCDE-FGHJK. Type it in the same box where you would type the six digits.
• To replace all of them, open Settings > Two-step login and choose Create new recovery codes. The old codes stop working at once. Arty sends you a security notice when you do this, and also when a recovery code is used to sign in.

Signing in with two-step login

Sign in with your email and password as usual. Arty then asks for your code: the six digits from the app, or one recovery code.

The code step has a short time limit. If it runs out, start again from the password. A wrong or already used code is refused, and too many wrong tries in a short time make you wait a moment.

Actions that ask you to confirm again

Some actions are sensitive enough that Arty asks for your password, and your code when two-step login is on, even though you are already signed in. After you confirm, you are not asked again for 10 minutes.

These actions ask you to confirm:

• changing your password or your email address
• turning two-step login on or off, and creating new recovery codes
• linking or unlinking Google sign-in
• closing your account
• changing the domain of a panel, or reverting that change
• canceling a panel at the end of its period, canceling one before it is activated, or reactivating one
• asking for a change of the panel owner email
• rotating the licence key of a panel
• giving a staff member a sensitive permission

A form you had just sent is not repeated for you after you confirm. The page tells you to send it again.

Turn two-step login off

Open Settings > Two-step login and choose Turn off. This asks you to confirm first, and Arty sends you a security notice afterwards.

You can turn it on again at any time. You get a new key and new recovery codes.

The sign-in check for panel staff

Every person who signs in to your panel, you included, passes a second step after the password. You choose which one, per person:

• Email code: a six-digit code is sent to the person's email address at every sign-in. The code works once and only for a short time. Asking for a new code is limited, and a code is burned after a few wrong guesses.
• Authenticator app: the person enters the six-digit code from an authenticator app at every sign-in. A person who has not connected the app yet first passes the email code, then scans a QR code on the panel and saves the recovery codes the panel shows.

To set it for a staff member, open your panel, go to Staff, choose Edit for that person and use the Sign-in check card. Pick the method under Second step after the password and press Save. The Staff list shows the current choice in the Sign-in check column.

The step is asked every time the person signs in. A staff member cannot skip it by remembering the browser. A staff member on the authenticator app cannot switch the app off inside the panel: the choice belongs to you, in your Arty account.

What happens when you change it

• Arty saves the choice and sends it to the panel. The page tells you so.
• The person is signed out of the panel and uses the new step at the next sign-in.
• You can change staff accounts while the panel is active. If the panel is in another state, the change is refused.
• The authenticator app starts to work when the server of your panel has been updated to support it. Until then the email code is asked, and the form says so.

Your own sign-in check as the owner

The owner of the panel has a sign-in check too. Open your panel, go to Settings and find the card Owner sign-in check. It works like the staff form: choose Email code or Authenticator app and press Save. You come back to the Settings page with the answer.

The owner email shown on that page is the address that gets your sign-in codes and the security notices of the panel. If you change it, both the old and the new address must confirm the change, and you must confirm with your password first.