Skip to main content

Two-factor authentication and passkeys

Guides

DataLug sign-in is passwordless: you enter your email and verify a one-time code or a sign-in link sent to your inbox. Two-factor authentication adds a second step: a rotating 6-digit code from an authenticator app. Passkeys let you sign in with your device instead.

Both are per user. You set them up under Account Profile > Security, and they do not affect anyone else on the account.

What is supported​

  • Authenticator app (TOTP). Works with Google Authenticator, Microsoft Authenticator, Authy, 1Password and other TOTP apps.
  • Recovery codes. 10 single-use backup codes issued when you turn two-factor on.
  • Email me a code. At the second step, DataLug can email you a one-time code instead.
  • Passkeys. Sign in with a passkey stored on your computer, phone or a hardware security key.

Turn on two-factor authentication​

  1. Open Account Profile > Security and find the Two-factor authentication card.
  2. Select Enable two-factor authentication, or the Authenticator app tile.
  3. Scan the QR code with your authenticator app. If you cannot scan it, type the key shown under the code into the app.
  4. Enter the current 6-digit code from the app, then select Verify and enable.
  5. DataLug shows your 10 recovery codes once. Use Copy all or Download .txt, store them safely, then select Done.
  6. The card shows Two-factor enabled (TOTP) with Regenerate recovery codes and Disable.
Save your recovery codes

The recovery codes are shown only once. If you lose both your authenticator app and your recovery codes, the account Owner emails DataLug support at support@datalug.io to reset your second factor.

Sign in with two-factor authentication​

  1. Sign in as usual: enter your email, then the one-time code or link from your inbox.
  2. DataLug asks for your authenticator code.
  3. Enter the current 6-digit code from your app and select Verify.

At the second step you can also:

  • Use a recovery code instead. The field then accepts one of your saved backup codes. Each recovery code works once.
  • Email me a code. DataLug emails a one-time code to your address, valid for about 10 minutes. Enter it in the same field.

Too many wrong codes lock the account for a short time.

Recovery codes​

  • You receive recovery codes when you turn two-factor on, and a new set each time you regenerate them.
  • Each code works once.
  • To replace them, select Regenerate recovery codes on the Two-factor authentication card and enter a current authenticator or recovery code. The previous set stops working, so save the new codes.

Turn off two-factor authentication​

  1. Open Account Profile > Security.
  2. On the Two-factor authentication card, select Disable.
  3. Enter a current authenticator or recovery code to confirm.

Your stored secret and recovery codes are removed, and your next sign-in skips the second step. You can turn it on again at any time.

Passkeys​

A passkey signs you in with your device's screen lock or a hardware security key, with no email code.

  1. Open Account Profile > Security and find the Passkeys card.
  2. Select Add passkey and give it a name, for example the device it is on.
  3. Follow your browser's prompt.
  4. If DataLug shows passkey recovery codes, save them.

To sign in with it, select Sign in with a passkey on the sign-in page.

On the Passkeys card you can rename or remove each passkey. A removed passkey cannot be used to sign in until you add it again.

Some organizations require a passkey to sign in. The sign-in page then says so.

Lost device and lost codes​

If you lose both your authenticator app and your recovery codes, the account Owner emails DataLug support at support@datalug.io. The reset is recorded in the audit log, and your next sign-in skips the second step so you can turn it on again from Account Profile > Security.

Good to know​

  • The authenticator secret is encrypted and is never sent back to the browser.
  • Codes change every 30 seconds. DataLug accepts codes within about 90 seconds of the current time. If your codes are never accepted, set your phone's clock to update automatically.
  • The secret cannot be changed in place. If it is exposed, turn two-factor off and on again.