Set up two-factor sign-in and passkeys

Last verified

Two-factor sign-in means a stolen password is not enough to get into your account. After your password, veldhost asks for a second thing only you have: a code from an authenticator app on your phone, or a passkey (a security key such as a YubiKey, or your device's own unlock).

Everything here lives on one page: Settings → Security. It shows Second factor, Authenticator and Passkeys at the top, and every way you sign in under Sign-in methods.

Before you start

  • New veldhost accounts require two-factor sign-in for every member, so you may be asked to set it up the first time you sign in. Until you do, the portal keeps sending you to the Security page with the note Your account requires two-factor sign-in. Owners and Administrators can switch the requirement on or off: see Roles and permissions.
  • The requirement also applies to API tokens and connected AI assistants. A token belonging to someone without a second factor is refused until they set one up.
  • Adding or removing a sign-in method asks you to confirm your password first, if you have not just done so. The change goes ahead once you have.

Set up both an authenticator and a passkey if you can. Each is the backup for the other.

Set up an authenticator app

Any authenticator app that shows time-based (TOTP) codes works, including the one built into many password managers.

  1. Open Settings → Security. Under Sign-in methods, on the Authenticator app row, choose Enable authenticator.
  2. Scan the QR code with your app. If you can't scan it, type the code shown next to it into the app instead.
  3. Enter the code the app shows and choose Confirm code.
  4. Your recovery codes appear once, straight away. Save them now in a password manager or print them. Each one signs you in once if you lose your phone, and we cannot show them again.

The Authenticator app row now says On. The recovery codes stay on the page until you choose I have saved them.

To stop using the app, choose Turn off authenticator on the same row and confirm your password. If your account requires two-factor sign-in and the app is your only second factor, the button is off: add a passkey first.

Confirm it by email

When the authenticator is on, we email your address to confirm that you set it up. Open the link and choose Yes, I set up 2FA. If the email does not arrive, use Resend confirmation email on the Security page.

If you did not set it up, someone else may have your password. Use the lock-account link in the same email and choose Lock my account. That signs out every device at once and stops anyone signing in until we have checked it is you. Your sites and email keep running while the account is locked. To unlock it, contact us.

Add a passkey

  1. Open Settings → Security and choose Add passkey. Confirm your password if asked.
  2. Give the key a name you'll recognise later in Passkey name, for example "YubiKey" or "Work laptop".
  3. Choose Register passkey and follow your browser: touch the key, or unlock with your fingerprint, face or device PIN.

The passkey appears as its own row under Sign-in methods, with the date you added it and when it was last used. Add a second key if you have one, so losing one key doesn't lock you out.

Signing in afterwards

You always enter your password first. Then:

  • With a passkey: on Confirm your security key, choose Use your security key and touch or unlock it.
  • With only an authenticator: on Two-factor required, enter the Authenticator code from your app.

If you don't have your key or phone

  • Passkey not to hand, and you also set up an authenticator: on the security-key step, choose I don't have my security key. Enter the Email code we send you, plus either an Authenticator code or a Recovery code, and choose Sign in. Resend email code sends a new one.
  • Phone lost: enter one of your saved codes in Recovery code instead of the authenticator code. Each recovery code works once.
  • Passkey only, and the key is lost: the sign-in page tells you to email security@veldhost.eu from the address on your account. Do the same if you have lost your phone, your key and your recovery codes. We check your identity against the details we hold before we restore access.

Once you are back in, make new recovery codes (below) and remove the lost key.

Make new recovery codes

Do this when you have used some codes, or think someone else may have seen them.

Caution: your old recovery codes stop working as soon as the new ones are made. Have somewhere ready to save the new set before you continue.

  1. Open Settings → Security. On the Authenticator app row, choose Regenerate recovery codes.
  2. Confirm your password if asked.
  3. Save the new codes shown on the page. They are shown only this once.

Remove a passkey

Remove a key you have lost, given away or stopped using.

Caution: if this is your only second factor, sign-in falls back to your password alone, or, when your account requires two-factor, you are sent to set up a new one. The confirmation box tells you which applies before you agree.

  1. Open Settings → Security. Under Sign-in methods, find the passkey's row and choose Remove.
  2. Read the warning and choose Remove passkey. Confirm your password if asked.

The row disappears, and that key no longer works for signing in.

Stuck? Contact support — replies within one business day.