2FA (two-factor authentication) asks for a second thing at sign-in: your password, and then a 6-digit code from an authenticator app on your phone. A password on its own stops being enough, which is the point.
What you need: an authenticator app on your phone, and a password on your ReviewComet account. If you sign in with Google, Microsoft or Facebook and have never set a password here, that provider already asks you for its own second factor. Set a password in Settings first if you want one on ReviewComet as well.
Turn it on
- Open Settings, then Profile, and find the 2FA card.
- Press Turn on 2FA and type your password.
- Scan the QR code with your authenticator app. If the camera is not an option, type the setup key underneath it into the app by hand.
- Type the 6 digits the app shows and press Turn on.
Your app lists the account under the name you signed in with, so a client of an agency sees their provider's name and nothing else.
The two-factor card in settings showing a QR code, the setup key in text and a box for the 6-digit code.
Turning it on signs out every other browser holding your account. That is deliberate: a second factor is usually something people add because they no longer trust a session somewhere, and leaving those sessions alive would have done nothing.
Save your recovery codes
You are shown 10 recovery codes once, and once only. Copy them or download the file, and keep them somewhere that is not the phone your authenticator app is on.
Each code works one time. They are the only way back into the account if your phone is lost, wiped or replaced, so treat them like a spare key rather than a note.
Ten recovery codes in two monospace columns with Copy and Download buttons underneath.
You can replace them at any time from the same card: New recovery codes asks for your password and a code, then shows 10 fresh ones. The 10 you had stop working the moment the new ones appear.
Signing in with a code
Type your email and password as usual. Instead of going straight in, the screen asks for the 6 digits your app is showing.
The sign-in screen asking for a 6-digit authentication code.
That screen is good for 5 minutes and 5 wrong codes. If it expires or locks, sign in with your password again and you get a new one. Codes change every 30 seconds, so a code that was refused a moment ago is worth retrying with the next one your app shows.
If you sign in with Google, Microsoft or Facebook, nothing changes: that provider handles your second factor and ReviewComet does not ask for a second one on top.
Remembered browsers
The code screen has a Remember this browser for 30 days box. Tick it and that browser stops asking for the code for the next 30 days. Your password is still asked for every single time, so a remembered browser is a shortcut past the second step and never past the first.
Only tick it on a device that is yours. A shared or public computer is exactly the case the box is not for.
Your remembered browsers are listed on the 2FA card in Settings, with the one you are reading this on marked. Revoke takes one off the list and Revoke all clears them; either way you stay signed in, and the browser asks for a code again the next time you sign in.
Four things clear the list for you: turning 2FA off, changing your password, support@reviewcomet.com resetting your second factor, and the 30 days running out.
Turn it off
Open the same card and press Turn off. It asks for your password and a code, because taking the second factor away is exactly the thing somebody who stole a session would want to do.
If your organization requires 2FA for your role, the Turn off button is not there and the card says so. Ask your account owner or an administrator to change the requirement first.
Required by your organization
An account owner or an administrator can require a second factor for staff, or for everybody including clients. When it applies to you and you have not set one up, the next screen after sign-in is the setup one, and nothing else opens until it is done. The card tells you the date you have until.
Owners and administrators set this on the Settings, Team screen, where the roster shows which people already have it on.
If you lose your phone
Use one of your recovery codes on the sign-in screen: press Use a recovery code instead, type it, and you are in. Then turn 2FA off and on again on the new phone, or generate fresh recovery codes.
If the phone is gone and you have no recovery codes left, nobody can read your codes back to you: they are stored as digests, not as text. Ask your account owner, or ask support@reviewcomet.com. They can turn 2FA off on your account after checking it is you, and you will get an email saying it happened.