Docs
Type to search every article.
  1. Docs
  2. Account

Signing in and two-factor authentication

You sign in with your email alone: we email a sign-in link and a six-digit code that work once, for 15 minutes. Lockouts, sessions, changing your email and two-factor authentication.

3 min read Updated

On this page
  1. Signing in
  2. Lockouts
  3. Sessions
  4. Changing your email address
  5. Two-factor authentication

You sign in with your email address alone: we email you a sign-in link and a six-digit code, and either one signs you in once, within 15 minutes. There is no password. A session lasts 28 days from its last use, ten wrong codes pause the code for up to 15 minutes, and two-factor authentication, where it is on, asks for a code from your authenticator app after that.

Signing in#

On the sign-in page, enter the address you sign in with and press Email me a sign-in link. The email holds two ways in:

  • The link signs you in on the device you open it on, once you press Sign in on the page it opens. Opening it alone changes nothing, so a mail scanner that opens links cannot use it.
  • The code signs in the browser you asked from: enter it on the sign-in page there, for when you read your email on another device. It works only in that browser, and five wrong codes stop it working.

Each email works once, for 15 minutes; asking again sends another; the one before keeps its link working, and its code is replaced by the new one in that browser. The page answers the same way whether or not an address has a login, and only an address with a login is sent an email. If it doesn't arrive, check your spam folder, then press Send a new email; Use a different email starts again.

Lockouts#

Ten sign-in emails asked for from the address you connect from within 15 minutes stop that address asking for more until fewer than ten fall inside the last 15 minutes. One email address is sent at most ten sign-in emails in 15 minutes; asking for more is answered as usual, but nothing more is sent. Ten wrong codes within 15 minutes, counted for the email address and for the address you connect from, pause the code the same way, while a sign-in link always works. A successful sign-in clears the counts for that email address. Two-factor codes have a count of their own.

Sessions#

A session ends 28 days after its last use, and each request moves that forward. What ends one early: signing out; switching two-factor authentication on or off, which ends your other sessions; a change to your permission level; revoking the session from the Users page; being removed from the account; and the account being suspended, which signs every user out.

Changing your email address#

Your email address changes only once both inboxes have confirmed it. Under Account, Settings, Sign-in Email, press Change email and enter the new address. We email a link to your current address; once you confirm there, we email a link to the new one. Your email changes when you confirm that, and your old address is told. You stay signed in throughout, each link works for 24 hours, and Resend email and Cancel change are in the same place.

Opening a link changes nothing until you press its button. If you can no longer read your current address, email our team: once we have checked it's you, we can change it for you, and your sign-in emails then go to the new address.

Two-factor authentication#

Under Account then Settings, in Security Settings, switch 2-Factor Authentication on and scan the QR code, or type the setup key, into any app that produces time-based codes. The page makes a new key each time it is opened, so add it to the app and enter the code in the same visit. A refused code keeps that key: enter the code the app shows now, with no need to scan again. Enabling it signs out your other sessions. Each code is accepted once: one that was just used, to sign in or to switch two-factor authentication on, is refused if typed again, so wait for the app's next code. Switching it off asks for the code the app shows now, then turns it off and signs out your other sessions; on an account that enforces two-factor authentication, switching it off sends you straight back to the setup page.

A Full Access user can switch on Enforce 2FA for All Users. From then on any user on the account who has not set it up is taken to the setup page on their next request, signed in already or not, and cannot go anywhere else until it is done.

If you lose your authenticator, email team@cachegenie.com from the address you sign in with and quote the account's support PIN, which another user on the account can read from the Support page. Our team switches two-factor authentication off, signs you out everywhere and emails you; sign in with your email and set it up again.