Two-step verification
Set up an authenticator app so Agoo asks for a six-digit code each time you sign in, step by step for first-timers.
Agoo is in early access. This page describes the feature as it ships to early-access organisations; screens are illustrative.
Two-step verification means signing in takes two things: your password (or an email code) and a six-digit code from an app on your phone. Someone who steals or guesses your password still can't get in without your phone.
Owners and Admins must use it. So does everyone in an organisation that turns it on (Settings → Security). Everyone else can turn it on, and we recommend it.
What you need
A phone and a free authenticator app. If you've never used one, pick one of these:
| App | iPhone | Android |
|---|---|---|
| Google Authenticator | App Store | Google Play |
| Microsoft Authenticator | App Store | Google Play |
Both are free and work without a network connection once set up. If you already use 1Password, Bitwarden or your iPhone's Passwords app, those can hold the code too.
Install the app before you start
Get the app on your phone first, then come back to Agoo. The set-up takes about two minutes.
Set it up
You'll be asked the first time you sign in if your role needs it. Otherwise open Account → Sign-in and security → Two-step verification.
Show your QR code
Give this phone a name if you like (such as "My phone"), then choose I have the app: show my QR code. Agoo shows a QR code and, under it, the same thing as a setup key.
Add Agoo to the app
Open Google Authenticator, tap +, then Scan a QR code, and point your camera at the code on your screen.
"Agoo" appears in the app with a six-digit code that changes every 30 seconds.
Type the code into Agoo
Type the six-digit code the app shows into Agoo and choose Verify and continue. That's it: from now on Agoo asks for the current code each time you sign in.
Setting up on the same phone you're signing in on
You can't scan a code on your own screen. Tap Setting up on this phone? Add to my authenticator app instead: your phone opens the authenticator app with Agoo ready to add. If nothing opens, use the setup key below.
Signing in to the Agoo Workspace app for the first time works the same way: the app sets up your authenticator with you on the phone.
If the QR code won't scan
In the app, choose Enter a setup key (Google Authenticator) or Enter code manually (Microsoft Authenticator). Type any account name, such as "Agoo", then the setup key Agoo shows (tap the key in Agoo to copy it). Leave the type as time-based.
If a code doesn't work
- Use the newest code. Each code lasts 30 seconds. If it's about to change, wait for the next one.
- Check your phone's clock. Codes depend on the time. Set your phone's date and time to automatic (Settings → General → Date & Time on iPhone; Settings → System → Date & time on Android).
- Pick the right account. If the app holds several codes, use the one named Agoo.
Keep a spare
Add a second authenticator, on another phone or in a password manager, from Account → Sign-in and security → Add another authenticator. If you lose one phone, the other still works.
Use a passkey instead
A passkey counts as two-step verification by itself: sign in with one and Agoo asks for no code. If Agoo asks for your code after your password, choose Use a passkey to unlock with your face, fingerprint, screen lock or security key instead.
Backup codes
Backup codes stand in for your authenticator when your phone isn't to hand. Make them in Account → Sign-in and security, under Two-step verification → Backup codes: confirm with a code from your authenticator, and Agoo shows you ten codes, once. Save them somewhere safe away from your phone, such as a password manager or a printed page. Agoo keeps only a scrambled form of them, so it can't show them again.
- Each code works once. When Agoo asks for your six-digit code, in the Console or in Agoo Workspace, choose Use a backup code.
- Using one takes your authenticators off, because your phone may be in someone else's hands, and ends your other sign-ins. You set up your authenticator again straight away.
- Making a new set stops every old code working. Agoo tells you when you're running low.
- Agoo emails you whenever codes are made or one is used, so you'd know if it wasn't you.
Lost your phone?
Use a backup code if you have one. If you've lost every authenticator and have no backup codes, choose Lost your phone? when Agoo asks for your code. We email a link to your sign-in address, then an Owner or Admin of your organisation checks it's really you and approves (or Agoo does, after its own identity check, and the reset waits 24 hours). Then you set up your new phone. The full steps are in Account recovery.