Two-factor sign-in, passwords and sessions

Your account page, My account, is where you look after your own sign-in: change your password, turn on two-factor sign-in, renew recovery codes, and see every device where you're signed in. Owners and General Managers can also decide which roles must use two-factor sign-in.

Open My account #

1. Select your profile menu at the top right of the console.
2. Select My account.

(open full size)

1. Change password. Enter your current password and the new one twice.
2. Two-factor authentication. Turn it on, or generate new recovery codes once it is on.
3. Where you're signed in. Every browser or phone signed in to your account, with the device, its IP address and when it was last active. "this device" marks the one you're using.
4. Sign out all other devices. Ends every session except the one you're using.

Change your password #

1. Under Change password, enter your Current password.
2. Enter a New password and confirm it. It must:
   • be at least 12 characters;
   • not be a common password or a long run of one character;
   • not contain the name part of your email address.
3. Select Change password.

Changing your password signs you out everywhere else and ends any remembered devices. Forgot your password? Use Forgot password on the sign-in page; the reset link works once and expires after 60 minutes.

Turn on two-factor sign-in #

1. Under Two-factor authentication, select Enable two-factor.
2. Scan the QR code with an authenticator app, or copy the key into the app by hand.
3. Enter the 6-digit code and select Enable two-factor.
4. Save the 8 recovery codes. They are shown only once.

The full walk-through, including what to do if you lose your phone, is in Users, roles and two-factor sign-in.

Require two-factor sign-in for more roles #

1. Open Settings › Settings & domains.
2. Under Security, tick each role that must use two-factor sign-in. Tenant Owner is always ticked and can't be cleared. General Manager is ticked by default.
3. Select Save settings.

People in those roles are asked to set it up the next time they sign in. MotoDealerHQ can also require two-factor sign-in for every dealership user on the platform.

See and end your sessions #

1. Scroll to Where you're signed in.
2. To end one session, select Sign out on its row. That device is signed out on its next click.
3. To end every other session at once, select Sign out all other devices.

(open full size)

1. Your sessions. One row per signed-in browser or app.
2. Sign out. Ends that one session.

Sessions also end on their own after a period without activity (2 hours by default; MotoDealerHQ sets this). When you sign out yourself, that browser also stops receiving push notifications.

Remembered devices #

When you sign in with a code, you can tick Remember this device for 30 days. On that device you then skip the code (never the password) for 30 days.

• Only use it on a computer or phone that you alone use.
• Forget remembered devices on My account ends all of them at once. The list under Remembered for two-factor shows each one and when it expires.
• Changing your password also ends them.
• MotoDealerHQ can switch remembered devices off for everyone.

What else protects your sign-in #

• Lockout. After 8 failed attempts (wrong passwords or wrong codes), the account locks for 15 minutes.
• No account hints. Sign-in and reset pages never reveal whether an email has an account.
• Codes can't be replayed. Each 6-digit code works once, and each recovery code works once.
• Encrypted secrets. Your two-factor key is encrypted, and recovery codes are stored in a form that can't be read back.

Tips #

• Use a password manager to create and store a long, unique password.
• If you see a session you don't recognize, select Sign out all other devices and then change your password.
• Store recovery codes somewhere other than your phone.

Permissions #

Limitations #