Two-factor sign-in adds a second check after the password. Besides something the user knows (the password), they must show something they have: their email inbox or their phone. A stolen or guessed password is no longer enough to get in.
The second step is a 6-digit code. It works on the web sign-in page and at the Retail till, after the password and after the PIN.
Each user has one of three methods:
| Method | How the user gets the code | Needs |
|---|---|---|
| None | No code - password only | - |
| Email code | A new code is emailed at every sign-in | An email address on the user, and an email server configured in Datagate |
| Authenticator app | The code is shown by an app on the phone, changing every 30 seconds | A phone with Google Authenticator, Microsoft Authenticator or any other TOTP app |
The authenticator app works without network or mobile signal on the phone, and the Datagate server does not need to be reachable from the internet. Email code is simpler to start with, but depends on the mail server and on how fast emails arrive.
Two-factor is set per user, by an administrator, in the user's page under Admin → Users, in the Two-factor section. There is no global switch: the users who need it - administrators, managers, anyone working from outside the company - get it; the others keep signing in with the password only.
<!-- SCREENSHOT: Admin → Users → user page, Two-factor section with the method list and the status -->
Next to the method, the status shows where the user stands: the address the code goes to, or the date the authenticator app was set up.
Changing the method signs the user out on every device and cancels "Remember me on this device".
If the user still has their recovery codes, they sign in with one of them instead of the app code (see Signing In with a Code).
If not, the administrator presses Reset two-factor in the user's page. The old phone stops working at once, the user is signed out everywhere, and at the next sign-in they scan a new QR code with the new phone.
Only members of the Administrators role can open user, role and group management, and so only they can set or reset two-factor. A user cannot switch it off for themselves.
Every step is recorded in the user's audit history: the method set and by whom, the authenticator app set up, a reset and by whom, each successful and each wrong code, and each recovery code used. A series of wrong codes on an account is the sign that somebody else knows the password.
A user with two-factor can sign in only on the sign-in page and at the till. The API sign-in (/auth/login) and Basic authentication refuse them, because a program cannot type a code.
Integrations use their own dedicated users (the Device Sync group, see API Authentication), without two-factor. Do not turn on two-factor for these users - the integration stops at the next sign-in.