Using an authenticator app and backup codes

Email codes verify that you control your mailbox. An authenticator app adds a second step that an attacker with access to your email cannot pass. LexSalim supports standard time-based (TOTP) authenticator apps.

Turning it on

1. Sign in, open Settings → Security.
2. Choose Add authenticator app. For safety, this is only offered within a few minutes of signing in; if the option is greyed out, sign out and in again.
3. Scan the QR code with your authenticator app, or enter the key manually.
4. Enter the six-digit code the app shows to confirm.
5. Save your backup codes. They are shown once. Store them somewhere safe that is not your email account.

From then on, every sign-in asks for the authenticator code after the email code.

Backup codes

Each backup code works once. Use one if you lose your phone, then set up the authenticator again on the new device and generate a fresh set. Using a backup code sends a security notice to your email address so you know it happened.

Actions that ask for a fresh check

Some actions require that you passed the authenticator step within the last 15 minutes, even if you are already signed in:

• Turning two-factor authentication off.
• Regenerating backup codes.
• Changing your email address.
• Changing a member's role, removing a member, or updating or deleting the organisation.
• Inviting someone as an administrator.

If prompted, enter the current code from your app and continue.

Security notices

LexSalim emails you when two-factor authentication is enabled or disabled, when sessions are revoked, when your email address changes and when a backup code is used. If you receive a notice for something you did not do, revoke your sessions from Settings → Security and contact support.

Lost everything?

If you have lost both your authenticator and your backup codes, contact support from the email address on the account. Recovery is handled by a person and may take time, because we verify that the request is genuine.