Two-step verification: setting it up, and changing phones safely

At a Glance

You scan a square code with an authenticator app, type the 6-digit number it gives you, and from then on signing in needs your password and a current code; there are no backup codes, so the setup key is worth keeping.

Before you start

You need an authenticator app. TherapyLock names four on screen: Google Authenticator, Microsoft Authenticator, Authy and 1Password. Any of them works, and so does any other app of the same kind.

Google Authenticator and Microsoft Authenticator run on a phone only. Authy and 1Password also run on a computer, which is worth knowing if you would rather not involve a phone at all, or if you already use a password manager.

Practitioners turn it on from My Account. If you are accepting a clinical executor nomination, it is built into the invitation and you cannot skip it.

Setting it up

1. Go to My Account and find Two-step verification. Click Set up two-step verification.
2. A square QR code appears. Open your authenticator app, choose to add an account, and scan the code with your phone camera. If your authenticator lives on the same computer, use its own add-account option instead of the camera.
3. The app immediately shows a 6-digit number for TherapyLock, which changes every 30 seconds.
4. Type that number into the six boxes and confirm. The card then reads Two-step verification is on.

If you cannot scan the code

Under the QR code there is a line reading Can't scan? Enter this key manually: followed by a long string of letters and numbers, with a Copy setup key button beside it.

That key goes into your authenticator app, not into TherapyLock. Every authenticator offers a way to add an account by typing a key instead of scanning. Use it when the camera will not focus, when the screen is too small, or when your authenticator is on the same device as the page.

Keep the setup key

There are no recovery codes and no backup codes. TherapyLock cannot see your codes and cannot generate one for you.

That makes the setup key the one thing that lets you rebuild your authenticator on a new device without our help. Copy it somewhere safe and private when you set it up, such as a password manager or a locked drawer. Anyone holding that key can generate your codes, so treat it exactly as you treat your password.

Changing or replacing your phone

Move your authenticator across before you wipe or trade in the old phone. Most authenticator apps have their own transfer or cloud backup option, and that is the easy route.

If the old phone has already gone, add TherapyLock to the new app using the setup key you kept. If you did not keep it, contact us and we will help you back in.

If you are accepting a clinical executor nomination

The steps are the same, inside the invitation rather than in My Account. You set a password, scan the code, then click Verify and accept nomination.

Two things practitioners and executors both get wrong here:

• There is a step after the code. You are then shown the Executor Undertaking, which sets out your responsibilities, and you have to accept it. Only then are you taken to your executor dashboard
• Accepting gives you no access to anyone's records. You hold a nomination and nothing else. Access opens only if you later request it formally and a waiting period passes. When and how your clinical executor gets access covers that

If something's not right

• You are trying to install the authenticator on a laptop and the store will not let you. Google Authenticator and Microsoft Authenticator are phone apps. Either use your phone, or choose Authy or 1Password, which run on a computer
• The long key will not fit in the boxes. It is not meant to. The key goes into your authenticator app, and the app then gives you the six digits for the boxes
• The code is rejected. Codes last about 30 seconds. Wait for the next one and type it promptly. If it keeps failing, check the clock on the device running your authenticator is set to update automatically, because a drifting clock produces codes TherapyLock will not accept
• You have lost the phone and did not keep the setup key. Write to us from the email address on your account and we will help. We cannot do it by return of post, because we have to establish it is really you
• You want to turn it off. The same card in My Account offers Turn off two-step verification?. Think twice: it is the single strongest protection on an account holding client notes

Related articles

• Your first hour in the app — Quick start: your first hour in TherapyLock
• Why you are not asked for a code every time — Why am I still signed in when I reopen TherapyLock?
• Nominating someone in the first place — Setting up your clinical will in TherapyLock
• What an executor can actually do — When and how your clinical executor gets access

Still Need Help?

If you have any other questions about TherapyLock, our support team is here to help.

Email us at support@counsellingtutor.com and we will be happy to assist.