Two-Factor Authentication

Two-factor authentication (2FA) adds an extra layer of security to your Capacity account. With 2FA enabled, signing in requires something you know (your password) and something you have (a token generated on your mobile device) — so a compromised password alone isn't enough to access your account. This article covers how to enable 2FA on your own account, what sign-in looks like once it's on, and the different ways 2FA can be turned off.

Capacity uses Authy, a free mobile and desktop app, to generate two-factor authentication tokens. You can read more about Authy on its support site.

How It Works

Without 2FA, signing in to Capacity only requires your password. Once 2FA is enabled on your account, sign-in requires a second, independent factor: a one-time token generated by the Authy app on your mobile device, tied to the mobile number you register during setup.

This means that even if your password is compromised, an attacker would also need access to your physical device to sign in as you. 2FA can be enabled by any user for their own account, and can also be turned off by a Capacity Admin for any user in your organization — for example, if someone loses their phone and needs to regain access.

2FA and SSO are mutually exclusive. If your environment is configured for single sign-on (SSO), 2FA isn't available — sign-in security in that case is handled by your identity provider instead. This article only applies to environments that use standard username/password sign-in.

Before You Begin

To enable 2FA on your Capacity account, you'll need:

A mobile number that can receive SMS messages or phone calls. Standard text message rates may apply.
The Authy app, installed and set up on your mobile device (covered below).

Enable 2FA on Your Account

Install & Set Up Authy

Set up Authy first, so it's ready to generate a token when you enable 2FA in Capacity.

Install Authy from authy.com/install on your mobile device.
Enter your mobile phone number, including your country code, then confirm.
Enter your email address, then confirm.
Choose to receive your Authy registration code by phone call or text message, then enter that code into the app.
Authy may ask about push notifications — allow these. You can use them as an alternative to entering a token when you sign in (see Signing In with 2FA below).

Turn on 2FA in your profile

Log in to CI and go to your user Profile by selecting the arrow next to your profile initials, then selecting Profile.
In the Two-factor authentication section, select Enable.
Enter the mobile number where you'd like a verification code sent, including your country code, then select Send verification.
You'll receive a text message with a verification code. Enter it into your Capacity Profile and select Submit.
- If you don't receive a code, select Re-send code.
- If you entered the wrong number, select Change mobile number to try again.
Open the Authy app. It will display a token for your Capacity account.

The Authy token refreshes every 20 seconds. Enter it into Capacity right away — if it expires before you submit it, just enter the new token that appears.

Enter the Authy token into your Capacity Profile and select Submit.
Your Profile page will now show a Disable button in place of Enable, confirming 2FA is active.

Enforce 2FA for Your Whole Organization

You don't need to ask users to enable 2FA individually. If you'd like 2FA required for everyone in your organization, Capacity and we'll help you get it configured.

Signing In with 2FA Enabled

Once 2FA is on, you'll be asked to verify your identity.
After singing in with your username and password, you can either:

Open the Authy app, get your current token, and enter it after submitting your username and password; or
Leave the token field empty and select Sign in, then approve the push notification sent to your phone.

Following this:

You'll be signed in.
You can select Remember this computer for 30 days to skip this step entirely on that device for 30 days.
An incorrect token simply prompts you to try again.
After five incorrect attempts, your account will be locked, and you'll receive an email with instructions to unlock it.

Disable 2FA

You might need to turn 2FA off if you've lost your mobile device, changed your mobile number, or it's otherwise no longer working for you. There are two ways to do this:

Option 1: Self-disable from your profile

If you selected Remember this computer for 30 days when you last signed in, you can disable 2FA yourself without needing a token, as long as you're within that 30-day window and using the same device.

Option 2: Ask an Admin user to disable it for you

If you've lost access to your phone or changed your number and can no longer sign in, a CI Admin at your organization can disable 2FA on your behalf. If you're an Admin doing this for someone else:

Log in to CI and go to your user Profile by selecting the arrow next to your profile initials, then selecting Users.
Search for the user.
Select the user's name to open their profile.
In the Two-factor authentication section, select Disable.

Disabling a user's two-factor authentication cannot be undone. The user will need to re-enable and re-verify 2FA from their own account if they want it turned back on

Was this article helpful?