Skip to content
Prepare my pentest

Sign-in and second factor

Sign in with your password then a second factor (authenticator app or e-mail code), enable or remove a factor, reset your password, and what is required depending on the role.

How-to guide · For everyone2 min read

Markdown versionOpen in ChatGPTOpen in Claude

Signing in#

  1. Enter your e-mail and your password.
  2. If a second factor is enrolled on your account, choose it at each sign-in: the code from your authenticator app, or a six-digit code sent by e-mail. Both can coexist.

There is neither a magic link nor a code-only sign-in: a mailbox is never enough to open a session.

The second factor#

FactorHow it works
Authenticator appA one-time code generated by a compatible app (TOTP).
E-mail codeA six-digit code sent to your address, valid for ten minutes. Five attempts at most, one send per minute, six per hour.

Who must enable it#

  • Clients and firm administrators are offered it only once, after signup or the first sign-in ("app", "e-mail code" or "later"). It is never imposed.
  • SpectrAI platform operators must enable it.

Some actions require a session verified by second factor, for example adding a site, an agent or an internal test authorisation, or some agency operations. The application indicates it where relevant.

Enabling, adding or removing a factor#

From My account, security section:

  • enable an authenticator app by scanning the displayed code and confirming a code;
  • enable the e-mail code;
  • remove a factor. Removing the e-mail factor requires a verified session, and it is refused as long as an unrecognised app remains active on the account.

Forgotten password#

Request a reset from the sign-in page. The link you receive opens the new password page. A reset followed by an e-mail code does not count as a verified session: sign in normally afterwards for the actions that require it.

Signup and approval#

Signup confirms the e-mail address. A direct signup is approved automatically when catalogue sales are open to signup; otherwise, the waiting page explains it until approval by an operator. An invitation received from a colleague or a firm keeps its own flow.