All topics
Two-step verification Everyone
Confirm each sign-in with an emailed code, or set up an authenticator app and keep recovery codes for a lost phone.
After your password, mapzaa always asks for a second thing: a six-digit code. Everyone gets it by email to start with, and that needs no setting up. If you would rather not wait for a mail, or don't want your mailbox to be the key to your account, you can have an authenticator app on your phone give you the code instead. It is optional, it is your own choice, and it works the same for every role.
Setting up an app
Any app that makes time-based codes works: Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden, Authy and others.
- Go to Settings › Two-step verification and press Set up app. Nothing about signing in changes yet.
- In your app, add an account and scan the code on the page. On the phone itself, use Add to an app on this phone; if you can't scan, type the key shown beside the code.
- Enter the six-digit code the app shows and press Turn on. Until you do, sign-ins keep using emailed codes, and Cancel setup leaves everything as it was.
- You are shown ten recovery codes. Keep them somewhere safe, away from your phone — Copy codes or Download them. They are only shown this once.
From then on, signing in asks for the code from your app, and no code is emailed. You get an email whenever an app is added to or removed from your account.
Code not accepted? The codes are based on the time, so make sure your phone sets its clock automatically. Each code works once.
Without your phone
On the sign-in page, choose Use a recovery code and type one of your saved codes. Each works once; afterwards mapzaa shows you how many are left. Make new codes gives you a fresh set of ten and stops the old ones working — it asks for your password.
If you have lost your phone and your recovery codes, ask an administrator in your organisation: Reset app in Managing people puts you back on emailed codes, and you can set up an app again. There is deliberately no way to fall back to email from the sign-in page itself, since that would let anyone with your mailbox get round the app.
Going back to emailed codes
Press Remove app and enter your password. Your recovery codes stop working with it. The same is true for a new phone: remove the app, then set it up again on the new one.
Two-step verification isn't offered in the demo, which skips the second step altogether. If your organisation uses single sign-on, signing in that way asks for neither kind of code: your identity provider does its own checks.
Something not covered here?
Email [email protected] — we usually reply the same day. If you are not set up yet, we will put your municipality on the map in about twenty minutes.