Two-step sign-in and passkeys

You sign in to CommentGate with a link or a code sent to your email. You can make that stronger with a passkey, an authenticator app, or both. All of it lives on Settings, then Security.

Add a passkey

A passkey lets you sign in with your face, fingerprint or screen lock instead of waiting for an email.

1. Under Your sign-in, find Passkeys and select Add a passkey (the plus button).
2. Follow your device’s prompt.

Next time, choose Sign in with a passkey on the sign-in page. A passkey sign-in is already two steps (your device and your face, fingerprint or PIN), so it never asks for an extra code.

Add one passkey per device you use. You can rename or remove each one from the same list.

Turn on two-step sign-in

With two-step sign-in on, after your email link or code, CommentGate also asks for a 6-digit code from an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator, 1Password or Authy.

1. Under Your sign-in, find Two-step sign-in and select Set up.
2. Select Set up the app.
3. In your authenticator app, add an account and scan the code on screen.
4. Type the 6 digits the app shows, and select Turn on.
5. Save the backup codes it shows you, for example in your password manager. You will not see them again.

If you lose your phone

On the second step, use one of your backup codes instead of the app code. Each code works once. You can also sign in with a passkey.

Once you are back in, open the menu next to Two-step sign-in to make New backup codes (the old ones stop working) or Turn off two-step sign-in. Both ask for a code from the app.

If you have lost both your phone and your backup codes, and have no passkey, contact us.

Require two-step sign-in for everyone

Owners and admins can make two-step sign-in mandatory for a brand:

1. Under Everyone in this brand, turn on Require two-step for everyone.
2. The row lists who has not set it up yet. They are asked to set it up the next time they open CommentGate, before they can do anything else.

A few details:

• Clients are never asked.
• It needs an authenticator app. A passkey alone does not count.
• While a brand requires it, members of that brand cannot turn their own two-step sign-in off.

Every change here is recorded in the audit log.