Two-step verification (also called MFA or 2FA) asks for a 6-digit code from an app on your phone after your password. A stolen or guessed password alone then can't open your workspace. SeatReaper checks this in the database itself, so it also protects your data from direct API calls.
Set it up
- Install an authenticator app: Microsoft Authenticator, Google Authenticator, 1Password, Bitwarden or similar.
- In SeatReaper, open Settings > Security and select Set up two-step verification.
- Scan the QR code with the app. If you can't scan, open Enter the key instead and type the key.
- Enter the 6-digit code the app shows.
- Save your recovery codes (below).
SeatReaper uses app codes only. It does not send codes by text message, because phone numbers can be hijacked.
Signing in
After your password, SeatReaper asks for the current code from your app. Codes change every 30 seconds. If a code is rejected, check that your phone sets its time automatically and try the newest code.
Add a second authenticator
Under Settings > Security, select Add another authenticator and set up a second phone or a password manager. Then one lost device never locks you out.
Recovery codes
When you first set up an authenticator you get 10 recovery codes, shown once. Download or copy them and keep them somewhere safe and offline. SeatReaper stores only a one-way hash of each code.
If you lose every authenticator, choose Use a recovery code on the code screen. A recovery code:
- works once,
- removes your old authenticators and signs you out everywhere else,
- then asks you to set up a new authenticator straight away.
After five wrong codes, recovery is paused for 15 minutes. Create a fresh set any time under Settings > Security; that stops the old set working.
Lost your phone and your codes?
- Techs and viewers: ask an owner on your team to reset your two-step verification under Settings > Security.
- Owners: ask another owner, or contact SeatReaper support. Support confirms your identity outside the app (for example on a video call) before resetting it.
A reset removes your authenticators and recovery codes and signs you out of every device. It needs a written reason and is recorded in the audit log.
Require it for your whole team
Owners can turn on Require two-step verification under Settings > Security. Anyone without an authenticator is then asked to set one up before they can see anything. You need two-step verification on your own login before you can turn this on.
Signing in with Microsoft
If you sign in with your Microsoft work account, verify with your authenticator after Microsoft when two-step verification is required. See Sign in with Microsoft.