Common questions: two-factor login and security

Quick answers about the Security page. Two-factor login (also called 2FA or MFA) adds a second step to signing in: a 6-digit code from an app on your phone.

Where to find it

Settings → Security. Every signed-in team member can open it to set up their own authenticator. Only the Owner can change the business-wide requirement.

Questions and answers

How does sign-in work? Is there a password?

There is no password. You type your email, press Send OTP, and enter the one-time password (OTP) Renta emails you. Two-factor, if you turn it on, is an extra code on top of that email code. See Setting up two-factor login for your account.

How do I set up two-factor login for myself?

Go to Settings → Security and press Set up two-factor login in the Your authenticator app card. Scan the QR code with an authenticator app, type the 6-digit code it shows, and press Confirm. Nothing changes until that code is accepted. Renta then shows your backup codes (see below).

Which authenticator apps work?

Any app that makes 6-digit codes. Renta names Google Authenticator, 1Password, and Authy, and says "any of them". The code changes every 30 seconds.

I can't scan the QR code. What do I do?

Under the QR code, find "Can't scan? Type this key instead" and type that key into your authenticator app by hand.

How do I know whether two-factor is on for me?

The badge on the Your authenticator app card reads Set up or Not set up.

If I set it up, will I be asked for a code every time I sign in?

Only once your business's requirement is in force. Until then the card says "You will be asked for a code the next time your business requires it." When the Owner has just switched the requirement on, people who already set up an authenticator are not asked until the 14-day grace window ends. After that, Renta asks for the 6-digit code from your authenticator app, and once you have entered one the card says "You have already entered a code in this browser session."

What are backup codes?

Ten one-time codes made when you set up your authenticator. They are your way back in if your phone is lost, broken, or wiped. Each works once. Renta shows them only once, so print them or save them in a password manager, not on the phone. To close the box you must tick "I have saved these somewhere I can reach without my phone." and press Done.

How do I get new backup codes?

Press Generate new backup codes in the Backup codes card. The old set stops working immediately. The card shows how many unused codes you have left, and warns you when it is down to two or fewer. The button only appears once your authenticator is set up.

I lost my phone. How do I get in?

At the code prompt, press Lost your phone? Use a backup code, type one backup code (it looks like ABCDE-12345), and press Continue. Using a backup code removes your current authenticator, so Renta then asks you to set up a new one straight away.

I lost my phone and my backup codes. What now?

Email Renta support at team@rentalabs.io. Renta staff have a reset tool that clears your authenticator and backup codes. It does not turn the business requirement off; you set up a new authenticator afterwards.

How do I move to a new phone?

Go to Settings → Security and press Replace with a new authenticator. Scan the new QR code and confirm with a code. Save the fresh backup codes it gives you.

How do I require two-factor for my whole team?

The Owner opens Settings → Security and, under Require two-factor for everyone, presses Require two-factor (14-day grace period). Everyone with access to your admin then has to use an authenticator app. See Requiring two-factor for your whole team.

Will turning that on lock my team out today?

No. Renta gives your team 14 days to set it up and reminds them each time they sign in with a banner: "Two-factor login becomes required for this business on [date]" with a Set it up now link. On the Security page the card reads "Currently: required" and says nobody is stopped until that date.

What happens when the 14 days are over?

Anyone who has not set up an authenticator sees a "Start setup" screen they cannot get past until they finish. Anyone who has set one up is asked for their 6-digit code. The screen also has a Sign out link.

How do I stop requiring two-factor?

The Owner presses Stop requiring two-factor on the same card. Renta confirms "Two-factor is no longer required for your team."

Why can't I change the team requirement?

Only the account Owner can. Everyone else sees "Only the account owner can change this." Each person can still set up their own authenticator.