This article covers the sign-in settings on your Bobbin profile: two-factor authentication, recovery codes and changing your sign-in email. It also explains how an Administrator can help someone who's locked out.
Note: People who sign in through TutorCruncher manage their sign-in, email and two-factor authentication in TutorCruncher, not in Bobbin.
Two-factor authentication
Two-factor authentication asks for a code from an authenticator app on your phone, such as Google Authenticator, Authy or 1Password, as well as your password each time you sign in.
Turning it on
On your profile, find Two-factor authentication and click Turn on.
Enter your current password and click Continue.
Scan the QR code with your authenticator app. If it won't scan, click Can't scan it? and type in the setup key instead.
Enter the 6-digit code your app shows and click Turn on.
Save your ten recovery codes, then click I've saved them.
Turning two-factor authentication on or off signs you out of Bobbin everywhere else, including the mobile app. Sign in there again to keep getting notifications.
Recovery codes
Recovery codes let you sign in if you lose your phone. Each code works once. They're only shown when you create them, so keep them somewhere safe.
To sign in with one, choose to use a recovery code on the sign-in screen and enter it in place of the 6-digit code. You'll get an email to let you know a code was used.
Your profile shows how many unused codes you have left, and warns you when you're running low.
To get a fresh set, click Create new codes and enter a code from your authenticator app. Your old codes stop working straight away.
If you turned on two-factor authentication before recovery codes were added, you won't have any yet. Click Create codes on your profile to make a set.
Turning it off
Click Turn off and enter your password along with either a code from your authenticator app or one of your recovery codes.
Changing your sign-in email
On your profile details, click Change next to your email address.
Enter your new email and your current password, plus a code from your authenticator app if you use two-factor authentication. A recovery code can't be used here.
Open the link sent to your new address while you're still signed in to Bobbin, and confirm.
Nothing changes until you confirm. Your old address gets a notice about the request. After the change goes through, you'll need to sign in again with your new email.
The link works once and expires after 24 hours. It also stops working if you change your password in the meantime.
Changing your password
Changing your password signs you out of Bobbin on your other devices, so anyone using an old session has to sign in again.
Administrators helping someone who's locked out
If someone has lost both their phone and their recovery codes, an Administrator can turn off their two-factor authentication. Open the person's profile, click Reset two-factor, and confirm with your own password. Only do this once you're sure the request really came from them.
The person is emailed to say their two-factor authentication was reset, and they can set it up again from their profile.
If the person also works with another agency on Bobbin
Some people use one Bobbin account with more than one agency. To protect their access everywhere, a few things work differently for them:
Resetting two-factor: Bobbin doesn't turn it off straight away. It emails them a link instead, and two-factor stays on until they click it.
Changing their name or email: you can't change these for them. They can update their own email from their profile, or contact support.