Your users' sign-in

Your application has its own users: your staff, and sometimes your customers. They are not people on your Divvent account, and Divvent never sees who they are. This article is about them. For your own sign-in to Divvent, see Signing in, passkeys and recovery codes.

Inside your application, its administrators invite people, reset their sign-in and remove them. The Your users' sign-in tab, under Settings, is for the two times nobody inside can help:

• someone has lost every passkey and authenticator app, and there is nobody inside to reset them — often because they are the only administrator;
• nobody can get in as the application's administrator at all.

Only an owner of your Divvent account sees this tab.

How your users sign in

How each kind of user signs in is part of your application, and you change it by asking for a change like any other. The ways it can offer:

• A password, with a second step where it matters.
• A passkey on their phone or computer. This is the default for anyone who can run the whole application, such as an administrator.
• An authenticator app as the second step after a password.
• A link by email, for people who sign in now and then.
• A work account with Microsoft or Google. Staff sign in with the account your business already gives them, and turning that account off stops them signing in. You connect Microsoft or Google on the Integrations tab. See Connect other services.
• A class code and a picture password, for people who should not need an email address or a password of their own, such as young children. An adult they are with, such as a teacher, puts a short code up for the group. Each device types it once, each person picks their name, and, where it is set up, taps four pictures they remember. Nobody in that group gives an email address or a phone number.

Unless your application says otherwise, a role that can run the whole application, or can delete sensitive records such as health or money records, must use a passkey or a second step.

Reset somebody's second factor

Use this when someone in your application has lost every passkey and authenticator app, and nobody inside can reset them.

1. Open your application, then Settings, then Your users' sign-in.
2. Under Reset somebody's second factor, type their email address in your application, and type it again to confirm.
3. If your application has a test copy, choose Where: the live application, or the test copy.
4. Press Reset their second factor.

Their passkeys, authenticator app and backup codes are removed, and they are signed out everywhere. Their password stays. The next time they sign in, they set up a new passkey or authenticator app.

Divvent can't tell you whether the address belongs to anyone, because we never see who is in your application. The page answers the same way either way. Your application records the reset, and names you as the person who asked for it.

Hand it to a new owner

Use this when nobody can get into your application as its administrator: the first administrator's link ran out or never arrived, or your only administrator has left.

1. Open your application, then Settings, then Your users' sign-in.
2. Under Hand it to a new owner, type the new owner's email address, and type it again to confirm.
3. Choose Where if your application has a test copy.
4. Press Hand it over.

This hands someone the whole application, so it needs a recent sign-in. If the page asks, sign in again with your passkey or authenticator app, and hand it over within five minutes.

What happens next:

• Your application makes a one-time link that makes whoever takes it up, with that address, its administrator. The link is emailed to them.
• The link is also shown to you on the page, once. Nothing keeps it, so copy it now if the email may not reach them. If they use this copy, they still need to open the emailed link to confirm their address.
• The link works for seven days. The page says when it starts to work. Where your application already has users, there is a wait before it does — usually a day, for a live application — so that its current administrators have time to notice.
• Your application emails its current administrators to tell them, and the owners of your Divvent account are told too.
• Nobody already in the application is removed. If the new owner already has a sign-in there, they sign in with it and accept.

The handover then shows on your application's Releases page. An owner can press Cancel the handover there until it is taken up. Any administrator inside the application can cancel it too, so a handover can't be used to take an application away from the people running it.

Once the new owner has taken it up, it can no longer be cancelled.

If you leave Divvent

If you take your application off Divvent, this tab no longer works for it: your application's own administrators reset, invite and remove people from inside it. See Export your application and your data.