Adds a second barrier to entry: in addition to your password, a code is needed that changes every 30 seconds and is only on your phone.
Protects access to the panel even if your password is leaked or someone guesses it.
Covers a common requirement of your organization's security policies and external audits.
It's per user, not per company. Each person activates it on their own account. Activating it doesn't obligate or affect the rest of your team.
You need a code app on your phone. The platform recommends Google Authenticator, and the first step of the wizard includes links to the App Store and Play Store. It works with any temporary code app.
Have your phone on hand before you start: the wizard is completed in one go.
Navigation: Settings → Security → Two-Factor Authentication card → Set Up button.
A four-screen wizard opens:
It recommends Google Authenticator and gives you the links to download it. If you already have it installed, continue with Next.
Shows a QR code to scan with the app, and below it the same code in text in case you prefer to enter it manually. Once the app finishes registering Whalemate, it starts showing a 6-digit code that renews every 30 seconds.
Enter the 6-digit code you see in the app and press Verify. If it's correct, "All set!" appears; if not, "Invalid verification code. Try again."
This step confirms that the app was registered correctly. It's worth doing: it's the only way to check it before closing the session.
Shows 8 backup codes with a button to copy them all together.
Copy the codes before closing the wizard. They are shown only once and cannot be viewed again. Save them somewhere you can find them without your phone: they're what allows you to log in if you lose it, replace it, or it runs out of battery.
Authentication becomes active from the moment you press Set Up, not when you finish the wizard. That's why it's advisable to complete all four steps in the same session: if you close the wizard before scanning the QR code and copying the backup codes, the next time you log in the panel will ask you for a code and you won't have a way to get it. If this happens to you, write to us and we'll fix it.
After your email and password, a screen appears with the Code field and the Validate button.
Here two things work:
The 6-digit code the app shows at that moment.
Any of your backup codes. Each one works only once: once used it becomes invalid and cannot be reused.
If the code is not correct, the screen shows "Incorrect or expired code". There is a limit of 5 attempts every 15 minutes; if you exceed it, you have to wait before trying again.
In Settings → Security, the Two-Factor Authentication card switches to showing the Delete button. Pressing it asks for confirmation and warns that the account becomes less secure.
Deleting it also erases your backup codes. If you activate it again later, the QR code and the 8 backup codes are new: you have to register the app again and save the new codes. The previous ones stop working.
I lost my phone or changed it. How do I log in?
Use one of your backup codes in the login's Code field. Once inside, go to Settings → Security, press Delete and set up authentication again with the new phone.
I ran out of backup codes.
New codes cannot be generated without setting up authentication again. If you still have access with the app, log in, delete two-factor authentication and activate it again: this generates 8 new codes. If you have neither the app nor codes, write to us to recover the account.
Do I activate it for the whole company?
No. It's a setting for your own user. If your organization needs the whole team to use it, each person has to activate it on their account.
The app gives me a code and the panel doesn't accept it.
The most common cause is the phone's time being out of sync with the actual time: the app calculates the code based on the time, so it's enough to turn on automatic time on the phone. Also keep in mind that each code lasts about 30 seconds, so it's best to enter it as soon as it appears.
Does another app work besides Google Authenticator?
Yes. Google Authenticator is the one we recommend and the one that appears in the wizard, but the QR code is standard and works with any temporary code app.
Do you have feedback or want to request improvements? Let us know at roadmap.whalemate.com/roadmap
