Your 2FA Settings

Manage your enrolled 2FA methods from your own account. Your administrator's 2FA requirements determine which methods are available and whether you may sign in without 2FA.

The methods below are not equally strong. Set up a hardware key or an authenticator app if you can, fall back to SMS if you cannot, and choose email verification last, because its codes arrive in the same mailbox as the password reset link.

For WebAuthn methods on a site with Custom Domains, sign in through the Primary Custom Domain before setting up the method.

Adding a 2FA method uses re-authentication to confirm your identity before changing how you sign in. When prompted, enter your password if this is your first method, or verify with one of your existing active 2FA methods if you have already enrolled. The re-authentication control has exceptions for some SSO users.

Setting Up 2FA With a Yubikey

When you select this method, you will see an animated image directing you to insert your Yubikey into your computer's USB port.

Yubikeys are available in USB-A and USB-C configurations. Be sure to purchase the correct version for your computer.

Enter an optional name for your Yubikey so you can identify it later, and then insert your Yubikey and place your cursor in the Yubikey code field.

Tap the activation button on your Yubikey. The Yubikey will enter the code into the field and will send the enter command all in one operation.

Your 2FA method is now added and active.

Setting Up 2FA With an Authenticator App

For this method, you will need to have your authenticator app of choice already installed on your mobile device. Popular choices include Google Authenticator, Duo, and Authy. These are also available and easily found in the app store for your device.

When you select this method, you will see a QR code with instructions.

Open your authenticator app and follow its instructions to add new credentials. Most apps offer you a plus sign to tap to add credentials and then offer options to either Scan barcode/QR code OR a Manual entry.

Choose the Scan method, and on the scanner window on your device, align the guides so that they enclose the QR code displayed on your Files.com site.

As soon as your device recognizes the code, your app will generate your new 2FA credential and show you your 2FA code. This may appear in a list of other credentials if you use your authenticator app for more than one system.

Enter an optional name in the App/device name field so that you can identify which 2FA method and device you are using, then enter the 2FA code displayed on your device in the field labeled Authenticator code and confirm the authenticator code.

Your 2FA method is now added and active.

Each authenticator code has a 30-second life span, which counts down on your authenticator app. If your code is about to expire in a few seconds, wait for the next code before entering it into the confirmation field.

Setting Up 2FA With SMS

Selecting this method reveals the phone number field.

Click the flag to the left of the field if you need to change to a different country where your phone number is based. Remember to re-authenticate with your password (or an existing 2FA method if so directed) before clicking Next.

Files.com will text you a six digit verification code.

Enter that code into the SMS code field, and click the Confirm code button.

Your 2FA method is now added and active.

Setting Up 2FA With Email

When you select this method, Files.com emails a verification code to the user's account address.

Each code is valid for 10 minutes and works for only one use.

Enter the code to finish setting up 2FA with email.

After successful verification, Files.com redirects the user to the login page and emails a new code for that login attempt.

Custom Domain Changes

Users with Yubikey, WebAuthn, or FIDO authentication are tied specifically to the login domain of your site. If you change your site's custom domain settings, every user with this type of 2FA enabled will need to remove their existing 2FA settings and re-configure them. This follows the WebAuthn requirement that devices generate site-specific public/private key pairs.

When the change would affect users, you'll see a message similar to this when you attempt to change the domain:

If your site has X users using a Yubikey or Webauthn-based two-factor authentication (2FA) method. These methods are tied to the existing domain. If you change your domain, these 2FA methods will be removed and users will be required to re-register these methods.

Additional Custom Domains

Yubikey, WebAuthn, and FIDO 2FA methods can only be set up while logged in through your Primary Custom Domain. If you try to configure one of these methods while logged in through a site alias Custom Domain, you'll see a message like this:

Your account is configured for login using a custom domain https://your-primary-domain.com, and the chosen 2FA method is tied specifically to the custom domain of your site to align with the WebAuthn / FIDO2 standards requirement. To set up this selected 2FA type, please log in using the custom domain URL https://your-primary-domain.com.

Starting a login with an already-configured Yubikey, WebAuthn, or FIDO credential works from any configured Custom Domain. The authentication step happens against your Primary Custom Domain automatically, and your session ends up on the Primary Custom Domain rather than the address you started at.

Removing the 2FA Requirement from Your Account

Users can remove the 2FA requirement from their own account from the My Account page by providing a valid code or confirmation from one of their existing 2FA methods, if site-level enforcement settings allow it or their Site Administrator has permitted them to do so. Valid confirmation methods include a hardware key, YubiKey (native mode), authenticator app, SMS, or email verification. If none of the 2FA methods are accessible, for example if a device is lost, a Site Administrator must remove the 2FA requirement on the user's behalf.