Two-factor sign-in

A password can be guessed, reused or phished. A second factor means a stolen password on its own is not enough: signing in also needs the six-digit code your phone is showing right now.

FlowArray uses standard TOTP, so any authenticator works — Google Authenticator, 1Password, Authy, Bitwarden. Nothing to install from us.

Turning it on

Settings → Security → Set up two-factor.

1. Scan the QR code with your authenticator app.
2. Can’t scan it? Press Can’t scan the code? and type the key in by hand instead — every app has an "enter a key manually" option. Case and the spaces do not matter.
3. Enter the six-digit code the app shows. This step is what proves the app and the clock agree, so nothing is switched on until it succeeds.
4. Save your recovery codes. Ten of them, shown once. You have to confirm you have saved them before the setup finishes — this is deliberate, because finishing setup without a way back in is how people lock themselves out.

Signing in afterwards

Password, then the code. If you signed in with Google, you are still asked for the code: Google proves who you are, not that you have your second factor.

“Don’t ask again on this device”

Tick it and that browser will not ask for a code again for 30 days. Worth knowing exactly what that means:

• It is 30 days from when you ticked it, and using it does not extend it. Trust is never permanent.
• For those 30 days, your password alone signs you in on that browser — so only tick it on a device only you use.
• Every trusted device is listed in Settings → Security with where and when it was trusted, and you can revoke any of them, or all at once if something goes missing.
• It is per browser, not per person: a different browser or a private window asks for a code.
• Trust is dropped automatically whenever the setup changes — if you re-do your two-factor, turn it off, an admin resets it, or you use a recovery code. A recovery code means your phone is gone, and at that point skipping the check is no longer a safe convenience.

If you lose your phone

Use a recovery code in place of the six-digit one — the sign-in page offers this directly. Each code works once. When you are running low, Settings → Security → Replace recovery codes issues a fresh ten (the old ones stop working immediately).

Out of recovery codes as well? An owner or admin can reset your two-factor from the Members page. You will get an email telling you it happened — if you did not ask for it, change your password and tell an owner, because somebody with admin access has removed a protection from your account. After a reset you sign in with your password and set two-factor up again.

If your workspace requires it

An admin can make two-factor compulsory for everyone (Settings → Workspace). When they switch it on, anyone who has not set it up is signed out and sets it up the next time they sign in — you cannot end up locked out by the requirement, because enrolling is the way through it. While a workspace requires it, you cannot turn your own two-factor off.

The limits, plainly

• Codes are accepted within about 30 seconds either side of the current one, to allow for a phone clock that is slightly off. If your codes are always rejected, check your phone’s automatic time setting.
• A code works once. Re-entering the same one, even inside its 30 seconds, is refused.
• Five wrong codes locks the code step for 15 minutes. A six-digit code with unlimited guesses would not be much of a factor.
• Your secret is encrypted in our database and is shown to you exactly once, during setup. We cannot read it back to you, and recovery codes are stored hashed — a lost code is replaced, never recovered.