Two-step sign-in (2FA) with an authenticator app
This page contains AI-generated content.
- On the broker’s path
- Platform
The problem this solves: A leaked password opens the whole client file of the firm: contacts, owners, prices, deals.
In short: With two-step sign-in, Capitality asks for a six-digit code from an authenticator app on your phone after your password or after signing in with Google or Microsoft. Someone who knows your password does not get into your account without your phone — and so not to your firm’s contacts, objects and deals. You switch on two-factor authentication (2FA) in the settings in two minutes.
What you can do
Section titled “What you can do”- Protect your account. A stolen or guessed password alone is no longer enough: the code changes every 30 seconds and is made only on your phone.
- Use the app you like. Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden, Authy — any app with time-based codes (TOTP).
- Get in without your phone. Ten backup codes, each valid once, for the day the phone is not at hand.
- Give trusted devices a rest. „Trust this device for 30 days“ — on your office computer Capitality then does not ask again for a month.
- With Google and Microsoft too. Two-step sign-in also applies after Google or Microsoft.
How to set it up
Section titled “How to set it up”- Open Settings → Profile, section Security, and click „Set up two-step sign-in“.
- Confirm with your password. (An account you made with Google has none; Capitality then does not ask for it.)
- Scan the QR code with your authenticator app. If scanning does not work, type the key shown below it into the app.
- Enter the code the app shows — two-step sign-in is now on.
- Save the backup codes: download them and keep them somewhere safe, for example in your password manager. They are shown only once.
How you sign in
Section titled “How you sign in”After your password, Google or Microsoft, Capitality opens the „Enter your code“ page. Type the current code from the app, or choose „Use a backup code instead“. The page waits ten minutes; after that you sign in again.
Limits and notes
Section titled “Limits and notes”- Wrong codes. After several wrong codes you sign in again; after many failed attempts Capitality locks sign-in for a while.
- Your phone’s clock. The codes depend on the time. If your phone’s clock is off, the codes do not match — set the time to automatic.
- New backup codes. „New backup codes“ makes the old ones invalid; Capitality asks for your password for it.
- Switching off. Only you switch two-step sign-in off, with your password. An admin of your firm cannot do it for you.
- Required for the whole firm. A rule „2FA for all members“ does not exist at the moment; each person decides for their own account.
- Phone and backup codes lost. Use the form „Cannot get into your account?“ — it is linked on the „Enter your code“ page too. We check that the account is yours before we help.
Frequently asked questions
Section titled “Frequently asked questions”Which authenticator app can I use? Any app with time-based codes (TOTP), for example Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden or Authy.
Does Capitality ask for the code after signing in with Google or Microsoft too? Yes, whether you signed in with your password, Google or Microsoft.
What do I do when my phone is gone? Sign in with a backup code, set up the app on the new phone and get new backup codes.
New in this feature
The changes of this feature, newest first — one line per change, with the version it shipped in.
No published change to this feature yet.