Two-factor authentication for operator sign-in
Add an authenticator-app or email code to password sign-in and complete mandatory setup when your website requires it.
What it is
2-Factor Authentication adds a code check to your INSIDE password sign-in. You can activate Auth Apps or Email from your account settings.
Your website can require operators to complete setup before they sign in.
Who uses it and why
Operators activate and verify their own factor. Users with the Settings or Manager role and the required operator permissions can enable or clear an operator's setup. Powerfront manages the website-wide requirement.
Where to find it
Open Settings › Account › My Account, then 2-Factor Authentication.
The operator-level switch is under Settings › Account › Operators. Powerfront manages Enforce 2-Factor Authentication under Settings › General Settings › Admin.
How it works
To activate an authenticator app:
- Choose Auth Apps under Authentication Method:.
- Select Activate Now and confirm your password.
- Scan the QR code with your authenticator app. Use Can't scan QR code? to enter the setup code manually instead.
- Enter the generated code and select Verify Code.
To activate email verification, choose Email, select Activate Now and confirm your password. Enter the code sent to your registered email address and select Verify Code.
At later password sign-ins, enter the requested code. Email codes expire two minutes after they are requested. If website enforcement requires setup and you have not completed it, the sign-in screen guides you through setup first.
For an enrolled authenticator account, Didn't get the code offers an email fallback. A valid fallback code lets you sign in without changing your configured authentication method.
Configure it
Ask Powerfront to turn on Enforce 2-Factor Authentication for your website. It is off by default.
You can use Deactivate Now in your personal setup when deactivation is available and confirm your password. Website enforcement will require setup again at a later password sign-in. An authorised account manager can also clear setup through the operator-level switch.
Don't ask again for this computer remembers successful verification in that browser. The default lifetime is 30 days; Powerfront can change it. You still need your password when signing in again.
Settings
| Setting | Where | Applies to | Default | Who can change it | What it does |
|---|---|---|---|---|---|
| Enforce 2-Factor Authentication | Settings › General Settings › Admin | website | Off | Powerfront | Require two-factor setup and verification during password sign-in. |
| 2-Factor Authentication | Settings › Account › Operators | operator | Off | Settings role, Manager role | Enable two-factor authentication for an individual account; disabling it clears its setup. |
| Authentication Method: | Settings › Account › My Account | operator | Auth Apps | Developer role, Co-Browse role, Manager role, Settings role, Chat role, Video Chat role, Live Shows role, Stats role, Monitor role, Top Stats role, Audit role, Bot Trainer role, Reports role, Reports Dashboard role, Store App role, Video Feed role | Choose Auth Apps or Email when activating two-factor authentication. |
Permissions
| Permission | Lets you |
|---|---|
| Settings | Manage permitted operator accounts, subject to Settings Permissions. |
| Operators | Allow operator administration within Settings Permissions. |
| Manager | Manage permitted operator accounts, subject to Manager Permissions. |
Limits and good to know
- Wait 60 seconds between email-code requests. Use the latest code you receive.
- Five failed email-code verifications clear the outstanding email code, so a new code is needed.
- Incorrect supplied codes also count towards the six-attempt sign-in lockout. Ask an authorised account manager to unlock a locked account.
- Password recovery clears factor setup. Complete setup again if enforcement is enabled.
- A remembered computer depends on its browser cookies and a valid remembered-computer token.
Depends on and works with
View all connections as a list
This feature uses
- Admin settings and feature switches · managed by PowerfrontConfigured by
Powerfront manages website-wide enforcement.
- Operator accountsConfigured by
Account management includes the operator-level authentication switch.
- Roles and permissionsConfigured by
Operator-management permissions control who can edit another account.
- Operator settingsConfigured by
Personal factor setup is in My Account.
- Login and email verificationRequires
These factors apply to the operator password sign-in flow.
- Password changes and recoveryEnhances
Password recovery clears two-factor setup, so enforced authentication must be set up again.
- Logout and remembered computersEnhances
A remembered computer can skip the code prompt on later password sign-ins.
- Sign-in and chat request limitsRelated
Incorrect supplied codes can count towards sign-in lockout, and email codes have separate retry limits.
Used by
- Operator accountsEnhances
Two-factor authentication adds an account sign-in requirement.
- Login and email verificationConfigured by
An account or website may require a second authentication factor.
- Password changes and recoveryEnhances
Password recovery resets two-factor setup, which may need to be completed again.
- Logout and remembered computersEnhances
Remembered-computer verification can avoid a later second-factor prompt.
- Operator access tokensEnhances
Remembered credentials can satisfy a subsequent second-factor check.
- Sign-in and chat request limitsRelated
Email second-factor codes have resend and failed-verification limits alongside sign-in lockout.
- INSIDE operator CLIConfigured by
The account's second-factor requirements apply to CLI sign-in.
FAQ and troubleshooting
Why is my email code rejected?
It may have expired, been replaced by a newer code or been cleared after failed attempts. Wait for the resend interval, request a new code and enter it within two minutes.
What if I cannot scan the QR code?
Choose Can't scan QR code? and enter the displayed setup code into your authenticator app. Finish by verifying a generated code.
I lost access to my authenticator app. Can I sign in?
Use Didn't get the code on the sign-in screen to request the email fallback. You need access to your registered email address.
Why is INSIDE asking for a code on a remembered computer?
The remembered verification may have expired, its token may no longer be valid or the browser cookies may have been cleared. Complete the code check again.
Why am I asked to activate it again after deactivating it?
Your website may enforce two-factor authentication. Deactivating your account setup does not turn off website enforcement.