Two-factor authentication (2FA) protects your sign-in to Candis with a second proof in addition to your password. In this article, you learn which methods exist, how to set them up, and how to sign in with them.
Who needs two-factor authentication?
Candis requires 2FA from all users who sign in with an email address and password. Your assigned role has no effect on 2FA. For 2FA, you need access to at least one of the following:
the Candis app on your smartphone
an authenticator app on your smartphone
the inbox of the email address you are registered with at Candis
a verified mobile number, if Candis offers sign-in by SMS for your user account
Note: If you sign in with single sign-on (SSO), Candis does not ask for separate 2FA because the SSO provider handles authentication.
Overview of available authentication methods
Candis offers three authentication methods:
Method | How it works | Recommendation |
Candis sends a request to the Candis app. You check the sign-in attempt and tap Confirm or Reject. | Recommended method | |
An authenticator app generates a six-digit code. You enter the current code when you sign in. | Recommended alternative | |
Candis sends a six-digit code to your email address. You enter the code when you sign in. | Alternative method |
Depending on your user account, Candis also shows SMS as an alternative method. To sign in with SMS, you need a verified mobile number from a supported country. Learn more in the article Supported countries for SMS verification.
Security: Use the Candis app or an authenticator app whenever possible. The email method separates your password and the additional factor less clearly if you use Candis and your email inbox on the same device.
Two-factor authentication with the Candis app
The Candis app is the recommended authentication method for signing in on the web. Once you have signed in to the Candis app once, Candis activates confirmation by push notification automatically, so you do not need to set it up separately in your Candis profile.
The Candis app opens the Confirm login attempt area. It shows the email address of the user account, your first and last name, and the browser with operating system used, e.g., “Chrome (Mac OS X).” Check the details and tap:
Confirm if you started the sign-in yourself.
Reject if you did not start the sign-in yourself.
Tip: Enable push notifications for the Candis app in your smartphone settings so you receive the request immediately.
You can find the complete step-by-step instructions for the push notification in the article Two-factor authentication with the Candis app.
Two-factor authentication with an authenticator app
An authenticator app generates time-limited codes on your smartphone. You can use, e.g., Google Authenticator, Microsoft Authenticator, or another compatible authenticator app.
Install an authenticator app from the App Store or Google Play Store before you set up the method in Candis.
Set up an authenticator app in Candis
Sign in to Candis.
Click your name at the bottom left and select My profile.
In the Account security area, find the Authenticator app entry.
Click Add.
Open the authenticator app on your smartphone.
In the authenticator app, select the function for scanning a QR code. The exact name depends on the authenticator app you use.
Scan the QR code that Candis shows on your computer.
Enter the six-digit code from the authenticator app in Candis.
Confirm the setup and close the window as soon as Candis confirms the successful setup.
The authenticator app generates a new code about every 30 seconds. If a code expires while you are entering it, enter the newly generated code.
Security: Do not share the QR code or the six-digit codes with anyone. Another person could use the QR code to gain access to the codes for your user account.
Sign in with an authenticator app
Open my.candis.io in your web browser.
Enter your email address and password.
Open the authenticator app on your smartphone.
In the authenticator app, find the entry for Candis.
Enter the six-digit code that the authenticator app shows for Candis.
Click Submit to confirm the sign-in.
If Candis does not accept the code, check the following:
Use the newest code from the authenticator app.
Wait for a new code if the current code is about to expire.
Check that the date and time on your smartphone are set automatically.
Check that you selected the Candis entry in the authenticator app.
Two-factor authentication by email
With the email method, Candis sends a six-digit code to the email address of your user account.
Open my.candis.io in your web browser.
Enter your email address and password.
Click Email under “Or try another way” if Candis first opens a different authentication method.
In the inbox of your email address registered with Candis, open the email to confirm the sign-in.
Enter the six-digit code on the Candis sign-in page.
Click Submit to confirm the sign-in.
Tip: Check your spam folder if you do not receive an email. Always use the newest code if you received several emails with codes.
The email code is valid for only one sign-in and for a maximum of 5 minutes. Click Request code again if the existing code has expired. An expired code does not work again.
No code, or the code had expired on arrival? You can find solutions under No email from Candis received and Code or link has already expired on arrival.
Use an alternative method
Use an alternative authentication method if you do not have access to your preferred method:
Open my.candis.io in your web browser.
Enter your email address and password.
Click one of the methods Candis shows for your user account under “Or try another way,” e.g., Email.
Confirm the sign-in with the selected method.
Candis shows only methods that are available for your user account. Depending on your user account, you can choose, e.g., email or SMS.
Tip: Use email or SMS as a temporary alternative. If possible, sign in to the Candis app again or set up an authenticator app.
Did you lose or replace your smartphone? You can find solutions under Smartphone lost or replaced.
Save two-factor authentication for 14 days
You can save a successful 2FA during sign-in on the device you are using for 14 days. Check the box This device can be used for 14 days without multi-factor authentication to enable the option. Candis does not ask for a new second factor on this device within the next 14 days.
Security: Save 2FA only on a personal, protected device. Do not enable the option on publicly accessible or shared computers.
Check your current authentication method
Sign in to Candis.
Click your name at the bottom left and select My profile.
In the Account security area, check the authentication method Candis shows for your user account.
Reject an unknown sign-in attempt
Tap Reject in the Candis app if you receive a sign-in request that you did not trigger yourself.
For security, then reset your password with Forgot password so nobody can sign in with your credentials. You can find the instructions under Forgot password.