Two-factor sign-in

What is an authenticator app?

A free app on your phone that shows a new 6-digit code every 30 seconds. When Resonia asks for a code, you open the app and type the one it shows. The app works without a signal.

Which app to use

• iPhone:nothing to install. It is built in: the Passwords app on iOS 18 and later, or Settings > Passwords on older versions.
• Android: install Google Authenticator or Microsoft Authenticator from the Play Store.
• Any other authenticator app (1Password, Authy and the like) works the same way.

Turn it on

1. Sign in on a computer and open your settings (Resonia staff: My account). Find Two-factor sign-in and choose Turn on two-factor sign-in.
2. If you have a password, enter it to confirm it is you.
3. A QR code appears. On an iPhone, open the Camera app, point it at the code and tap Add verification code. On Android, open your authenticator app, tap +, then Scan a QR code.
4. Can't scan? Enter the setup key shown under the QR code in your app instead.
5. Type the 6-digit code your app now shows and choose Turn on.
6. Save your backup codes somewhere safe, away from your phone: download them or copy them into a password manager. Each one signs you in once if you lose your phone, and they are shown only this once.

Passkeys

A passkey lets you sign in with the lock you already use on your device: Face ID, Touch ID, Windows Hello, or your phone held near your computer. There is no code to type and nothing to remember.

1. Sign in and open your settings (Resonia staff: My account). Find the Passkeys card and add one. Your device asks you to confirm with your face, fingerprint or device PIN.
2. Next time, choose Sign in with a passkey on the sign-in page.

Resonia staff: a passkey counts as your two-factor sign-in, so you can use one instead of an authenticator app.

Signing in each time

After your password, Resonia asks for a code. Open your authenticator app and type the 6-digit code shown for Resonia. If it is not accepted, wait for the next one and try again.

• Resonia staff are asked for a code on every new sign-in, even on a computer they have used before, and whether they sign in with a password or with Google.
• Therapists, supervisors and clientscan tick “Trust this device for 30 days” to skip the code on that device. Signing in with Google does not ask for a code.

Codes by email or text message

Therapists, supervisors, practice admins and clients can choose to get their code by email or by text message instead of from an app. When you turn on two-factor sign-in, choose Email code or Text message. We send you a code, and you type it in to finish turning it on. After that, each time you sign in with your password, we send a new code. It works once and expires after 10 minutes. If it does not arrive, check your junk folder or choose Send a new code.

Text messages go only to a mobile number you have verified in your settings, and they still arrive if you have turned text reminders off. While your codes are texted, you need to enter a code before you can change that number, and you choose another method before you can remove it.

Anyone who can get into your email can use emailed codes too, so keep your email account secure. Texted codes are the least secure option: someone who takes over your phone number can get them. We recommend a passkey or an authenticator app. Resonia staff cannot use email or text codes: they use an authenticator app or a passkey.

To change how you get codes, open Two-factor sign-in in your settings and choose Change method.

Lost or new phone

• Lost your phone? On the code screen, choose Use a backup code instead and enter one of your saved codes. Then go to Two-factor sign-in in your settings and choose Make new backup codes, so the old ones stop working.
• New phone? Move your codes before you wipe the old one. iPhone passwords move with your iCloud account. Google Authenticator and Microsoft Authenticator each have a transfer or backup option in their settings. Therapists, supervisors and clients can also turn two-factor off and on again in their settings and scan the new QR code.
• No phone and no backup codes? Sign in with a passkey if you added one. If not, contact Resonia support. Before resetting your two-factor sign-in, support will confirm it is you, by asking you to write from the email address on your account and to tell us something only you would know. We never ask about your health or your sessions. After the reset, sign in as usual and set two-factor up again when you are ready (Resonia staff are asked to straight away).