Two-Factor Authentication (2FA)

What it does

With two-factor authentication on, signing in takes your password (or magic link, or Google sign-in) and a 6-digit code from an authenticator app on your phone. Someone who learns your password still cannot get into your account, read your reviews or customers, or change anything.

Every Dinopix user can turn it on: owners, admins, members and client guests.

Turn it on

1. Install an authenticator app if you do not have one: Google Authenticator, Microsoft Authenticator, 1Password or Authy all work.
2. In Dinopix, open Settings, then Security, and choose Set up two-factor authentication. Client guests open it from the shield icon next to Sign out.
3. Scan the QR code with your app. If you cannot scan it, type in the setup key shown under it.
4. Enter the 6-digit code the app shows and choose Turn on 2FA.
5. Save your ten recovery codes. They are shown once. Download them or copy them into a password manager.

From then on, each new sign-in asks for a code. Other devices where you were already signed in ask for one the next time they are used.

Recovery codes

A recovery code gets you back in if you lose your phone or your authenticator app. Each code works once. On the sign-in code screen, choose Use a recovery code and type one in. That turns two-factor authentication off for your user so you can get in and set it up again on your new phone. Your other signed-in devices are signed out.

• We only store a scrambled fingerprint of each code, never the code itself, so nobody at Dinopix can read them back to you.
• You can create a new set at any time from Settings > Security. The old set stops working straight away.
• After five wrong codes, recovery is paused for 15 minutes.

Require 2FA for everyone in your account

The account owner can switch on Require 2FA for everyone in this account in Settings > Security. You need 2FA on yourself first, so you cannot lock yourself out by switching it on. The panel shows who already has 2FA, so you can warn the rest before you switch it on.

Once it is on, anyone in the account without 2FA is taken to the setup screen when they next open Dinopix, and cannot see or change anything until they finish. This is enforced on our servers, not just in the page: a password on its own cannot read your data through any route. Members of a team that requires 2FA cannot turn theirs off. Switching the requirement on or off is recorded in your audit log.

Turning it off

In Settings > Security, choose Turn off and confirm with a code from your app. This removes your authenticator and your recovery codes. If your team requires 2FA, the button explains that instead.

Locked out: no phone and no recovery codes

If you have lost both, Dinopix support can remove two-factor authentication from your user after checking it is really you. This is deliberately slower than signing in, because anyone could ask.

1. Email support@dinopix.com.au from the email address you sign in with, with the subject "Locked out of two-factor authentication".
2. Tell us your business name. If you are the account owner, we will also ask about your billing (for example the amount and date of your last invoice) to confirm you control the account.
3. If you are a member rather than the owner, we confirm with your account owner before removing anything.
4. Once confirmed, we remove your authenticator. You sign in with your password or a magic link, and set 2FA up again. If your team requires 2FA, you are asked to do that straight away.

We never remove two-factor authentication because of a phone call or a request from a different email address, and we never ask for your password.

Good to know

• Changing your password signs you out of your other devices.
• You can sign out of every other device at any time from Settings > Security.
• Two-factor authentication covers Google sign-in too: after Google, Dinopix still asks for your code.

See also security and data practices and roles and permissions.