Setting Up Two-Factor Authentication

Two-factor authentication (2FA) protects your account with a second proof of identity on top of your password, so a stolen password alone cannot get into your account. As your second factor you can use an authenticator app, passkeys, or both. This guide walks you through enabling 2FA with an authenticator app, saving your backup code, and what to do when you lose your phone. For how 2FA fits into sign-in and account security overall, see Authentication.

Before You Start

• Install an authenticator app on your phone (or a desktop equivalent) that generates time-based one-time passwords (TOTP). Most standard authenticator apps work.
• Have a safe place ready for one backup code: a password manager, or paper that is locked away.
• Setup cannot lock you out. 2FA only switches on after you have entered a working code.
• The authenticator app is set up in the web app. The mobile app asks for your code or passkey at sign-in, and since version 1.1.2 it can add passkeys itself under Settings ▸ Account ▸ Passkeys.

Enable Two-Factor Authentication

On the Security card, the status badge shows Disabled until you turn 2FA on.

1. Open your Profile and select the Security tab.
2. In the Security card, click Enable. A setup dialog opens with three steps.
3. Scan the QR code. In your authenticator app, add a new account and scan the QR code shown in the dialog. If you cannot scan, copy the secret under Manual Entry and type it into the app by hand. Click Next.
4. Save your backup code. The dialog shows your backup code (see Save Your Backup Code below). Store it before you continue. Click Next.
5. Verify and enable. Enter the current 6-digit code from your authenticator app and click Verify and Enable.

Once verified, the status badge changes to Enabled and shows the date 2FA was activated.

What Changes Once 2FA Is On

• Every sign-in asks for a code. After your password you enter the current 6-digit code from your authenticator app, or confirm with your passkey if you have one. This is the same in the browser and in the mobile app.
• You may sign in a little more often. If your organization has set a 2FA re-check interval, Mirox asks you to sign in again a set time after you last entered your code. By default there is no such interval. You sign in with your password and a code or your passkey and continue where you were. See Managing Your Sessions.
• You can use the device proxy. Opening a device's web interface through the Proxy is only possible with 2FA on your account.

Save Your Backup Code

When you enable 2FA you receive one single 8-character backup code. It is your way back in if you lose access to your authenticator app, so treat it like a spare key.

• Copy the code (use the copy button next to it) and store it somewhere safe and separate from your phone.
• The code is shown once, during setup. You only hold one backup code at a time. This is not a printable list of ten.
• You can only enter the backup code on the sign-in screen, in place of the 6-digit code.
• Using the backup code signs you in and switches the authenticator app off for your account. A passkey stays. No new backup code is issued. You set 2FA up again afterwards and receive a new backup code then.

Confirm Your App Is in Sync

After setup, you can check that your authenticator is generating valid codes without changing anything on your account.

1. On the Security card, click Check 2FA.
2. Enter a current code from your authenticator app.
3. A success message confirms the code is valid. This is a dry run. Nothing on your account changes.

Use this any time you are unsure whether your app is still in sync, for example after moving your authenticator to a new phone.

Manage Your Backup Code and 2FA

The Security card gives you three actions once 2FA is enabled:

• New Backup Codes — Issue a new backup code. You confirm with a current authenticator code first. The previous backup code stops working at once, so record the new one.
• Check 2FA — Run the no-change check described above.
• Disable — Turn 2FA off. You must enter a current authenticator code to confirm. Your account goes back to password-only sign-in until you enable 2FA again, unless you also have a passkey.

Passkeys

A passkey lets your device prove who you are: Face ID, Touch ID, Windows Hello or a security key instead of a typed code. It only works on the real Mirox sign-in page, so it cannot be phished. A passkey is a second factor on its own: you can use passkeys instead of an authenticator app, next to one, or not at all. Everywhere Mirox asks for a second factor, a passkey counts.

Add a passkey:

1. Open your Profile, select the Security tab and, in the Security card, click Add passkey under Passkeys. In the mobile app: Settings ▸ Account ▸ Passkeys ▸ Add passkey.
2. Confirm it is you: with a current code if you use an authenticator app, otherwise with your password. A passkey is a second factor on its own.
3. Follow your device's prompt (Face ID, Touch ID, Windows Hello, or touch your security key). Cancelling the prompt adds nothing.

The passkey appears in the list with the date it was added and last used. Rename it with the pencil, or remove it with the bin. Add a passkey on every device you sign in from, or keep an authenticator app as well, so you always have a factor at hand.

Sign in with a passkey: on the sign-in page choose Sign in with a passkey, enter your email and confirm on your device. You are signed in without a password, second factor included. If you sign in with your password instead, the code screen offers Use passkey next to the 6-digit code; the backup code remains available there as well.

On a device without your passkey: if a passkey is your only second factor, the code screen offers Send a code by e-mail. Mirox sends a one-time 6-digit code to your account's e-mail address; it is valid for a short time, and only one code is active at a time. Enter it to complete the sign-in. The mobile app offers the e-mail code too. Accounts with an authenticator app do not get the e-mail code; they use the app or the backup code.

Lost all your passkeys? Sign in with your password and the e-mail code, then add a new passkey or enable an authenticator app. You do not need support for this.

If an Organization Requires 2FA

2FA is your own choice by default. An organization can decide that its plants are only shown to users who have 2FA. The rule comes from the organization that owns the plant, so it can be your own organization or a cooperation partner whose plants you work on.

• Before the start date nothing changes for you. The date is always set at least 24 hours ahead, so use the time to enable 2FA.
• From the start date, if you have no 2FA, you no longer see that organization's plants: not in lists and dashboards, not on plant pages, not through the device proxy, in exports or in Grafana. Grafana follows within about an hour, both when the rule starts and after you enable 2FA.
• You stay signed in. Your profile, your settings and the organization pages keep working, and a hint in the header tells you to enable 2FA.
• Alarm notifications keep arriving, also for the hidden plants.
• As soon as you enable 2FA, the plants are back. Nobody has to unlock you.

Plants of other organizations are not affected. The details are on the Organization Security Policy page.

If You Lose Your Authenticator App

You also have a passkey: sign in with it; your account keeps its second factor.

You still have your backup code:

1. Sign in with your email address and password as usual.
2. On the two-factor screen, choose Use Backup Code and enter your 8-character code.

You have neither a backup code nor a passkey: contact Mirox support. Support can reset your second factor. This signs you out everywhere, in every browser and in the mobile app. You then sign in with your password and set 2FA up again.

Best Practices

• Enable 2FA on every account with access to plant operations. It is the single biggest improvement you can make to account security.
• Store your backup code somewhere you can reach without your phone.
• When you replace or reset your phone, set up the authenticator on the new device first, then run Check 2FA to confirm it works before you wipe the old one.
• Pair 2FA with regular session reviews so you can spot and sign out any device you do not recognize.

Related Guides

• Authentication — how sign-in, 2FA, sessions, and API tokens work together
• Organization Security Policy — the rules an organization can set for 2FA and sign-in duration
• Managing Your Sessions — review active sessions and sign out devices you no longer use
• Account Security FAQ — short answers on sign-outs, missing plants and lost authenticators
• Permission System — what your identity is allowed to reach once you are signed in