Guide
Guide
A second factor after the password: a code or a passkey. A stolen password is no longer enough to get in.
Two-factor authentication is included in every SpotBooker plan. Each person turns it on from their profile; the workspace administrator can require it for administrators and approvers, or for everyone. Microsoft, Google, SAML and LDAP sign-ins don't ask for a code: your identity provider already applies its own rules.
| Method | How it works |
|---|---|
| Authenticator app | Google Authenticator, Microsoft Authenticator, 1Password… Scan a QR code once; the app then shows a 6-digit code that changes every 30 seconds. |
| Email code | A 6-digit code, valid for 10 minutes, is sent to your address at each sign-in. The simplest, but the least secure: your administrator can refuse it. |
| Passkey or security key | Fingerprint, face, device PIN or physical key (YubiKey…). The safest: nothing to copy, and phishing-proof. |
The "Two-factor authentication" card lists the methods your workspace accepts.
App: scan the QR code, then enter the code shown. Email: enter the code you receive. Passkey: give it a name ("MacBook", "YubiKey"), then follow your browser's instructions. You can turn on several.
The first time, ten recovery codes are shown only once. Download them or copy them into your password manager: each one lets you sign in if you lose your phone or key. "Generate new codes" makes the old ones unusable.
After your password, SpotBooker asks for a code or your passkey. On a personal computer, tick "Trust this browser": it won't ask again for the period set by your workspace (30 days at most). The box is unticked by default.
Your profile lists the trusted browsers, with their IP address and expiry. "Remove" or "Remove all" makes them ask for a code again. Changing your password removes them all.
Recommended (everyone chooses, administrators and approvers see a reminder), required for administrators and approvers, or required for everyone.
From 0 to 30 days. During this period, a banner shows the days left; after that, signing in leads to an activation screen until the person has turned on a method. This applies to you too: turn yours on first.
Refusing email codes means an app or a passkey. Trusted browsers last from 0 (a code at every sign-in) to 30 days; the duration is fixed and is not extended by use.
Open their profile in Users, then "Reset two-factor authentication": their methods, recovery codes and trusted browsers are removed, and they are notified by email. An administrator cannot reset another administrator: write to SpotBooker support.
| What you see | What to do |
|---|---|
| "Incorrect or expired code" with the app | Check that your phone's time is set automatically: a drift of more than a minute makes the codes wrong. |
| The email code doesn't arrive | Check your spam folder, then use "Resend the code" (five sends per quarter of an hour at most). |
| No "Add a passkey" button | Your browser doesn't support passkeys: update it, or use the authenticator app. |
| Lost phone, no recovery codes left | Ask your workspace administrator to reset your two-factor authentication. If you are the administrator, write to SpotBooker support. |