# Sign-in and second factor

> Sign in with your password then a second factor (authenticator app or e-mail code), enable or remove a factor, reset your password, and what is required depending on the role.

## Signing in

1. Enter your e-mail and your password.
2. If a second factor is enrolled on your account, choose it at each sign-in: the code from your authenticator app, or a six-digit code sent by e-mail. Both can coexist.

There is neither a magic link nor a code-only sign-in: a mailbox is never enough to open a session.

## The second factor

| Factor | How it works |
|---|---|
| Authenticator app | A one-time code generated by a compatible app (TOTP). |
| E-mail code | A six-digit code sent to your address, valid for ten minutes. Five attempts at most, one send per minute, six per hour. |

### Who must enable it

- Clients and firm administrators are offered it only once, after signup or the first sign-in ("app", "e-mail code" or "later"). It is never imposed.
- SpectrAI platform operators must enable it.

Some actions require a session verified by second factor, for example adding a site, an agent or an internal test authorisation, or some agency operations. The application indicates it where relevant.

### Enabling, adding or removing a factor

From **My account**, security section:

- enable an authenticator app by scanning the displayed code and confirming a code;
- enable the e-mail code;
- remove a factor. Removing the e-mail factor requires a verified session, and it is refused as long as an unrecognised app remains active on the account.

> [!TIP]
> Enrol an authenticator app even if you use the e-mail code: you keep access if your mailbox is unavailable.

## Forgotten password

Request a reset from the sign-in page. The link you receive opens the new password page. A reset followed by an e-mail code does not count as a verified session: sign in normally afterwards for the actions that require it.

## Signup and approval

Signup confirms the e-mail address. A direct signup is approved automatically when catalogue sales are open to signup; otherwise, the waiting page explains it until approval by an operator. An invitation received from a colleague or a firm keeps its own flow.

---

https://docs.spectr-ai.eu/en/compte-et-securite/connexion-et-second-facteur