Two-step sign-in

Two-step sign-in adds a six-digit code from an authenticator app on your phone after your password, so a password alone can't open your account. Owners and admins of a church must have it on, and so must anyone with children's or giving access; everyone else can choose it. You get 14 days from the day it becomes needed, with reminders.

Set it up

1. Open your account menu, then Security.
2. Press Set it up · 2 minutes.
3. Name the device (iPhone, 1Password), then scan the square code with your authenticator app. Google Authenticator, 1Password, Authy, and your phone's own passwords app all work. You can type the key instead of scanning.
4. Enter the six digits the app shows. Two-step is on.
5. Save the ten recovery codes somewhere safe: copy them, print them, or write them down. Each works once.
6. Add a backup device if you have one (another phone, or a second app), or choose Later.

From then on, after your password, you enter the code your app shows. It changes every thirty seconds; the page sends itself when you type the sixth digit.

The 14 days

When two-step becomes needed for your role, a banner says the date. Everything keeps working until then. After the date, only the protected pages close until it's on: Access, Activity, the people export, and private notes. The stage, set lists, and the schedule never ask for a code, so a Sunday can't be stopped by a forgotten phone.

If you lose your phone

• A backup device gets you in: at the code, choose the other device.
• A recovery code gets you in too: choose Use a recovery code instead and type one of the ten you saved. Every device is removed, you're signed out everywhere else, and you have 14 days to set two-step up again. You and your church's owners get an email saying so.
• Lost everything? An owner of your church can ask PraisePad support to reset it. Support removes your devices with a reason you and the owners can read; you get a fresh 14 days.

Devices and codes

On Security you can Add a device (up to ten), Remove one, or make new recovery codes with Make new ones, which replaces the old ten. Removing a device signs you out everywhere else. While two-step is needed for your role, the last device can't be removed; add another first.

Changing your password

Once two-step is on, changing your password, deleting your account, exporting the people list, and a few other careful actions ask for a fresh code if your last one is older than ten minutes. That's "Confirm it's you."