Setting up Two-Factor Authentication

Two-factor authentication (2FA) is now required for everyone who signs in to the GiveTap admin panel. It can't be turned off. It helps protect your charity's account and donor data if your password is ever lost or stolen.

Mobile apps aren't affected: 2FA is only for the GiveTap admin panel. You don't need a code to sign in to the GiveTap card reader or Tap to Pay apps, and they work just as before.

2FA asks for a one-time code each time you sign in, as well as your password. You can get the code by email, which is the default, or from an authenticator app on your phone.

How 2FA works

Email codes (default): you don't need to set anything up. Each time you sign in, we email you a 6-digit code and you type it in after your password.
Already use an authenticator app? Nothing changes. You keep signing in with your app. If you'd rather use email codes, you can switch at any time in Settings > Security.

Signing in with an email code

Go to the sign-in page, enter your email address and password, and click "Login".
The "Check your email" screen opens. We send a 6-digit code to your email address (part of the address is hidden on screen).
Open the email from GiveTap. The subject line starts with the code, for example "123456 is your GiveTap sign-in code".
Type the code into the box and click "Verify".

Your first sign-in: the first time you're asked for an email code, you'll see the message "Email verification is now on for your account." You don't need to do anything else. After that, every sign-in asks for a code from your email.

Tip: email codes work well for shared inboxes, because anyone who can read the inbox can sign in. For the most security, use an authenticator app, as its codes come from your phone, not your inbox.

Check or change how you get codes

Go to Settings and open the Security tab. The "Two-factor authentication" panel shows how you get your codes:

On · Email codes: codes are emailed to the address shown.
On · Authenticator app: codes come from your app.

Prefer an authenticator app?

You'll need a phone with an authenticator app, such as Google Authenticator, Authy or Microsoft Authenticator, and a safe place to keep your backup codes, such as a password manager.

Go to Settings > Security and click "Set up authenticator app".
Scan: open your authenticator app, add a new account and scan the QR code on screen. If you can't scan it, type in the key shown instead (click "Copy" to copy it).
Verify: type the 6-digit code from your app into "Enter the 6-digit code from your app", then click "Verify and continue".
Save backup codes: click "Download .txt" or "Copy all" and store the codes somewhere safe. Tick "I've saved my backup codes somewhere safe", then click "Finish".

Warning: your backup codes are shown only once. Save them before you click "Finish". Each code lets you sign in once if you lose your phone.

From your next sign-in, after your password you'll see "Enter your authenticator code". Type the 6-digit code from your app and click "Verify".

Switch from your app to email codes

Go to Settings > Security and click "Switch to email codes".
To confirm, enter a current code from your app, or one of your backup codes, and click "Confirm".

From your next sign-in, we'll email you a code instead. Your old backup codes stop working.

Lost your phone or authenticator app?

On the sign-in page, enter your email address and password as usual.
On the "Enter your authenticator code" screen, type one of the backup codes you saved and click "Verify". Each backup code works once.
Go to Settings > Security, click "Switch to email codes" and confirm with another backup code. You'll then get your codes by email.
If you want to use an app on your new phone, click "Set up authenticator app" and follow the steps above.

If you've lost your phone and your backup codes, email support@givetap.co.uk from the email address on your account. For security, we'll need to check who you are before we can help.

Troubleshooting

My email code hasn't arrived: check your spam or junk folder. Codes come from GiveTap <noreply@givetap.co.uk>, so add this address to your safe senders list. Still nothing? Click "Didn't get it? Resend code". You can ask for a new code after 60 seconds, and only the newest code works.
My email code has expired: codes expire after 10 minutes. Click "Resend code", or click "Back to sign in" and sign in again to get a new one.
I typed the wrong code: you have 5 tries per code. After that, you'll go back to the sign-in page to start again.
"Too many sign-in codes have been sent": we send up to 5 codes an hour to each account. Wait a while, then try again.
My app code is rejected: make sure your phone's date and time are set automatically, then try the latest code.
I've lost access to my authenticator app: sign in with a backup code, then switch to email codes. See "Lost your phone or authenticator app?" above.
I need to change my email address: codes are always sent to the email address you sign in with. If that address is changing, ask another admin on your account to invite your new email address, then remove the old user once you can sign in. You can also email support@givetap.co.uk and we'll update it for you. Try to do this before you lose access to your old inbox.

Didn't try to sign in? If you get a sign-in code you didn't ask for, someone may have your password. Change it straight away using "Forgot your password?" on the sign-in page, and tell your account administrator. Nobody at GiveTap will ever ask you for your code.

You're done when…

Settings > Security shows "On · Email codes" or "On · Authenticator app".
Each time you sign in to the admin panel, you're asked for a 6-digit code from your email or your app. The mobile apps don't ask for one.
If you use an app, your backup codes are saved somewhere safe.