Skip to main content

Passwords and authenticator codes

Staff sign in with an email address and a password. An authenticator app on a phone adds a second step: a 6-digit code that changes every 30 seconds. Chiban asks for the code after the password, so a stolen password alone cannot open the account. Applicants and contractors sign in with a link sent by email and never see this.

Choosing a password​

A password must be at least 12 characters. A person chooses their first password from the invite link, and a new one from a reset link when an administrator sends it. Both links work once.

Staying signed in​

A staff sign-in lasts seven days. After that, the person signs in again.

If sign-in fails​

The sign-in page says "Email or password is incorrect", or "Email, password, or code is incorrect" when a code was entered. It does not say which part was wrong. After six attempts for the same email address within ten minutes, it says "Too many attempts. Try again in a few minutes." A disabled account cannot sign in at all. See changing roles, disabling accounts and resetting sign-in for the administrator's side.

Add an authenticator​

Each person does this for their own account. Administrators cannot turn one on for someone else.

  1. Open Account, then Authenticator settings.
  2. Choose Set up authenticator.
  3. Scan the QR code with an authenticator app on your phone. If you cannot scan it, type the key shown beneath the code into the app, or use Open in your authenticator app on the phone itself.
  4. Enter the 6-digit code the app shows and choose Confirm.

The Account page then reads "Set up. Sign-in asks for its 6-digit code." From the next sign-in, a 6-digit code from your authenticator box appears after the password, and the button changes to Verify and sign in.

Change your own name or password​

On Account, Your name changes how your name appears in Chiban. If your account has a password, a Password section asks for the current password and the new one twice. Changing it signs you out on every other device.

Lost phone​

An administrator clears the old authenticator on the person's page, and the person sets up a new one. See changing roles, disabling accounts and resetting sign-in.

In the demo​

The demo does not let visitors change a password, a name or an authenticator, because that would change the demo for everyone.