Two-step sign-in

With two-step sign-in, signing in takes your password and a 6-digit code from an authenticator app on your phone. Someone who learns your password still can’t get in.

Turning it on

1. Install an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator, 1Password, or Authy.
2. In the admin, click your name at the bottom of the menu to open Your account.
3. Choose Set up two-step sign-in.
4. In the app, add an account and scan the QR code. If you can’t scan it, open Can’t scan it? and type in the key instead.
5. Enter the 6-digit code the app shows, and choose Turn on two-step sign-in.
6. Save your recovery codes. You get ten, shown only once. Print them or keep them in a password manager. Each one signs you in once if you lose your phone.

Signing in

After your email and password, sc-cms asks for the code. Open the app and type the code it shows for your site. Codes change every 30 seconds, and each one works once.

If you see That code didn’t work, wait for the next code and check that your phone’s clock is set automatically. After five wrong codes, sign-in pauses for a few minutes.

Lost your phone?

• Enter one of your recovery codes in place of the code.
• Then, under Your account, turn two-step sign-in off and set it up again on your new phone, or make new recovery codes.
• No recovery codes left? Ask an administrator to reset your two-step sign-in. You’ll set it up again the next time you sign in.

Managing it

Under Your account you can:

• Make new recovery codes: the old ones stop working.
• Turn off two-step sign-in. Both need a current code (or a recovery code).

If your site requires two-step sign-in for staff, it can’t be turned off, and you’ll be asked to set it up the first time you sign in.

If you sign in with your organization’s account (single sign-on), your organization’s own sign-in protection applies instead.