Signing in, passkeys and recovery codes

Every Divvent account signs in with a password and a second factor: a passkey, or a code from an authenticator app. This article covers signing in, setting up and changing your second factor, and getting back in if you lose something.

Sign in

On Sign in, enter your Email address and Password, and press Sign in.

• If you use an authenticator app, you're then asked for the six-digit code the app is showing. Codes last thirty seconds, so if one is refused, try the next.
• If you use a passkey, press Sign in with a passkey instead of typing your password. Your device asks you to confirm, and you're in. This needs a browser that supports passkeys.

If you type your password when your account has a passkey, you land on Your sign-in and are asked to Use your passkey before anything else opens.

If sign-in is refused, the page says That email address and password do not match an account. It says the same for a wrong password and for an address with no account, so nobody can use it to find out who has one. After too many attempts, you're asked to wait fifteen minutes.

The code step lasts ten minutes. If it runs out, or too many codes are wrong, you're asked for your password again. Ten wrong codes in a row locks the code step for fifteen minutes.

New to Divvent? The sign-in page links to Start a free trial. See Sign up and your free trial.

Set up your second factor

Open Your sign-in from the link at the top of every page. Until you have a second factor, this is the only page that opens.

A passkey

A passkey is kept on your device (a phone, a laptop or a security key) and never leaves it. There's nothing to type, and a fake sign-in page can't capture it. It's the safer choice.

1. Press Use a passkey and follow your device's prompts.
2. You're shown ten recovery codes. Save them now: Copy, Download or Print them. This is the only time they're shown, and nobody at Divvent can read them back to you.
3. Press I have saved them.

To add a passkey on a second device, press Add a passkey from another device. Having two means losing one device doesn't lock you out. To remove one, open Remove beside it, type your password, and press Remove this passkey.

Passkeys need a browser with passkeys and scripting turned on. If yours can't, use an authenticator app.

An authenticator app

1. Type your password under An authenticator app and press Use an authenticator app.
2. Scan the code on the page with the app on your phone, or type the key in by hand.
3. Save the backup codes shown below it: copy, download or print them. They're shown only once.
4. Type a code from the app, tick I have saved my backup codes, and press Turn it on.

If the code is wrong, the page says so beside the box. The scan code and the backup codes stay as they were, so just try the next code.

To turn the app off later, type your password and press Turn the authenticator app off.

Once your first second factor is on, you go to Create your application if your company has none yet, or to Needs you.

Adding or removing a way to sign in needs a fresh proof of one you have. If the page asks, use your passkey or sign in again with your code, then make the change within five minutes. Turning on your first passkey or an authenticator app signs out every other session you have.

Recovery codes and backup codes

These are how you get back in if you lose your passkey or your phone. Each one works once.

• With a passkey, you have recovery codes. The Recovery codes part of Your sign-in says how many are left. Make new recovery codes gives you a fresh set, and every old one stops working. If you have none, Needs you shows Make them now.
• With an authenticator app, its backup codes are your recovery codes while it is on.

Use a code to get back in

• Lost your passkey: sign in with your email address and password. On Your sign-in, under Lost your passkey? One of your recovery codes, type a code and press Use a recovery code. Then add a passkey on a device you have now, and remove the one you lost. For safety, anything you add that day can't confirm erasing someone or handing over an application until the next day.
• Lost your phone: sign in with your password. At the code step, open Lost your device? Use a recovery code, type one of your backup codes, and press Sign in with a recovery code.

If you have lost everything

If you have no passkey, no authenticator app and no codes left, email hello@divvent.co.uk. Two people on our team must agree before anything is reset. You and every owner of your company are emailed before it happens. Then you sign in with your password, which is unchanged, and set up a new second factor.

Forgot your password?

1. On Sign in, choose Forgot your password?
2. Enter the address you sign in with and press Send the link.

The page answers every address the same way: if the address has a Divvent account, a link is on its way. That way nobody can use it to find out who has an account.

Set a new password

Open the link in the email. On Set a new password:

1. Type a New password (at least 12 characters), and The same again.
2. Press Set the password.

Keep in mind:

• The link works once, and for one hour. If it has expired or been used, choose Ask for a new one.
• Setting a new password signs you out everywhere, on every device.
• You're still asked for your passkey or authenticator app when you next sign in. A new password alone never gets anyone in.

If you belong to more than one company

Your second factor is how you sign in, not a setting of one company. If you belong to several, Your sign-in lists them under Where this applies, and one second factor covers them all.

Programs and terminals

At the bottom of Your sign-in, API tokens and webhooks is where you let a script or another program act as you. See The Divvent API.