Two-Factor Authentication
Two-factor authentication adds a second step to logging in with an email address and password. After the password, IPinfo asks for a six-digit code from an authenticator app, so a leaked password alone isn't enough to get into the account. It is available on every plan, free and paid. It is set up from the profile page.
Note: Two-factor authentication applies only to logging in to the IPinfo website. It doesn't affect API requests made with an access token.
Availability
- Any account that logs in with an email address and password can turn it on.
- An account that only logs in with Google or GitHub has no password login to protect, so the option is unavailable. Turn on two-step verification with Google or GitHub instead.
- A member of an organization that signs them in with single sign-on can't turn it on. Their identity provider handles the second factor.
- Each account has one authenticator app. Authenticator apps are the only supported method.
Which logins ask for a code
| Login | Asks for a code |
|---|---|
| Email and password | Yes |
| Google or GitHub | Yes |
| Single sign-on | Admins must have two-factor authentication turned on. For members, the organization's identity provider can handle it. |
Setting it up
- Install an authenticator app that supports time-based one-time passwords (TOTP), such as Google Authenticator, Microsoft Authenticator, or 1Password.
- Open the profile page and select Enable under Two-factor authentication.
- Enter the password you log in with and select Continue.
- Scan the QR code with the app. If you can't scan it, select Can't scan it? Enter this key instead and type the key into the app.
- Enter the six-digit code the app shows and select Turn on.
The app lists the entry as IPinfo, with the account's email address. From then on, every email and password login asks for a code from the app after the password. Every other session on the account is signed out, because those sessions started without a code, while the browser you set it up from stays logged in. After five wrong codes within ten minutes, the account accepts no more codes until those ten minutes are up.
Disabling it
Open the profile page, select Disable under Two-factor authentication, and enter a current code from the authenticator app. After that, logging in asks for the password only, and the IPinfo entry can be deleted from the app.
Disabling asks for a code so that someone using a browser that is already logged in can't remove the protection. Without the app, see the next section.
Lost access to your authenticator app
If you lose access to your authenticator app, contact support. Recovering the account may not be immediate, so an authenticator app that backs up or syncs its codes is strongly recommended.
Security emails
IPinfo emails the account's address when two-factor authentication is turned on, disabled, or removed by support. If you didn't make the change, contact support@ipinfo.io right away and reset your password.
Organizations and single sign-on
- Two-factor authentication belongs to each account. An organization owner can't turn it on or off for members.
- An organization owner who logs in with a password has to turn on two-factor authentication before setting up SSO. The SSO card on the organization page links to the profile page for it. An owner who only logs in with Google or GitHub skips this step.
- A member who already uses an authenticator app keeps it when their organization signs them in with SSO. SSO logins don't ask for the code, but if the member leaves the organization, password logins ask for it again.