Two-factor authentication

For: Everyone Where to find it: Click your avatar (bottom of the sidebar) → Settings → Two-factor auth

Two-factor authentication adds a second step to signing in, so a stolen password is not enough on its own to get into your account. Tourium supports two kinds of second step: an authenticator app that shows six-digit codes, and passkeys, which let you confirm it's you with your fingerprint, face or device PIN.

The top of the page tells you where you stand — Two-factor authentication is on or Two-factor authentication is off — and when it was switched on.

Common tasks

Set up an authenticator app

  1. Open Settings → Two-factor auth.
  2. Under Authenticator app, click Set up an authenticator app.
  3. Scan the QR code with Google Authenticator, Authy, 1Password or any other authenticator app. If you can't scan it, type the key shown under Can't scan it? Enter this key by hand into the app instead.
  4. Enter the Six-digit code the app shows, and click Turn on two-factor (or Add authenticator app, if two-factor is already on because you have a passkey).
  5. Tourium shows your recovery codes. Save them somewhere safe (see below), then confirm with I've saved these.

From now on, after you enter your password Tourium asks for the current six-digit code from your app.

Save your recovery codes

Recovery codes are the only way back into your account if you lose the phone or app that makes your codes. Each code works once.

  • Click Copy and paste them into a password manager or another safe place.
  • The page shows how many codes you have left.
  • To get a fresh set, click Generate new codes and confirm. Your old codes stop working immediately, so save the new ones straight away.

To use one, choose Use a recovery code instead on the sign-in code screen and type one of your saved codes.

Add a passkey

A passkey is stored on your device or in your password manager. It can't be phished, and it works either as your second step after your password, or on its own so you can sign in without a password at all.

  1. Under Passkeys, click Add a passkey.
  2. Follow your browser or device prompt (fingerprint, face or PIN).

Each passkey is listed with the date it was added and when it was last used. Use the menu next to a passkey to:

  • Rename passkey — give it a name you'll recognise, such as "Work laptop".
  • Remove passkey — you can no longer sign in with it. Remove it from your device or password manager too.

If your browser can't use passkeys, the page tells you so ("This browser does not support passkeys").

Sign in with a passkey

On the login page, click Sign in with a passkey and confirm on your device. You're signed straight in — no password or code needed. Your browser may also offer your passkey when you click into the email field.

If you sign in with your password instead and have a passkey set up, the second-step screen offers Use your passkey.

Remove your authenticator app or turn two-factor off

  • Remove authenticator app stops codes from the app working. If you still have passkeys, they keep protecting your account.
  • Turn off two-factor switches the second step off completely, leaving your account protected by your password alone. You can turn it back on at any time.

If your organisation requires two-factor authentication, you'll see "Your organisation requires two-factor authentication, so it cannot be turned off". You can still swap methods — for example remove your authenticator app once you have a passkey — but you can't remove your last remaining one.

The login page remembers how you signed in

The login page marks the method you used last time on this browser — a Google, LinkedIn, Facebook or Microsoft button, or Sign in with a passkey — with a Last used label. It's a handy reminder if you can't remember which way your account was set up.

Requiring two-factor for your whole organisation

An organisation's Owner can make two-factor authentication compulsory for everyone.

  1. Go to your organisation name → Details.
  2. Switch on Require two-factor authentication.

Once it's on, members who haven't set up two-factor are asked to do it the next time they use Tourium, before they can continue. They can set up a passkey or an authenticator app. When it's off, members can still turn two-factor on for themselves from their own settings.

You can see who has it set up on the Team page — the 2FA Status column shows 2FA or No 2FA for each member.

If a team member is locked out

If someone has lost their authenticator, their passkeys and their recovery codes, a team manager can reset them:

  1. Go to your organisation name → Team.
  2. Open the menu on that person's row and choose Reset two-factor.
  3. Confirm.

Their authenticator app, passkeys and recovery codes stop working, and they'll be asked to set two-factor up again the next time they sign in. Resetting needs the Manage organisation permission as well as access to the Team page.

Tips

  • Set up two methods — for example an authenticator app and a passkey — so losing one device doesn't lock you out.
  • Store your recovery codes somewhere other than the phone that runs your authenticator app.
  • Adding a passkey to a password manager that syncs across your devices means it's available everywhere you sign in.
Previous Touri Chat