Two-Factor Authentication and Your Password

What It Protects

Two-factor authentication adds a second step to signing in with your email address and password. After your password, BoutHost asks for a six-digit code from an authenticator app on your phone, so somebody who learns your password still cannot get in without the phone as well.

It applies to email-and-password sign-in only. Sign in with Webpoint never asks for a code: your federation’s own sign-in page decides who you are, so any extra protection on that route is set up with your federation, not here. If your account has no password because you have only ever signed in through Webpoint, two-factor has nothing to guard, and the screen says so instead of offering Enable 2FA. Set a password first (see below), and you can turn it on.

Turning It On

1. Open Settings → Two-factor auth.
2. Choose Enable 2FA.
3. Scan the QR code with your authenticator app. If you cannot scan it, type the key shown under Or enter this setup key manually: into the app instead.
4. Enter the six-digit code the app now shows under Verification code, and choose Confirm.

The screen then says Two-factor authentication is enabled. Until you confirm, nothing about signing in changes. If you leave the page halfway through, it picks up at the QR code next time; Cancel abandons the setup altogether.

Recovery Codes

Once two-factor is on, the screen has a Recovery codes section. They are not shown automatically, so choose Show recovery codes straight after turning two-factor on, and keep the eight codes somewhere safe that is not your phone.

Each code works once, in place of a code from your app, if you lose access to it. When you use one, a fresh code takes its place, so look at the list again afterwards and update the copy you keep.

Regenerate codes replaces the whole set. You are asked to confirm first, with your password, because your current codes stop working straight away, including any you have written down. The new ones are shown as soon as you confirm.

Signing In with a Code

Enter your email address and password as usual and choose Log in. A Two-factor authentication page then asks for the Authentication code from your app. Enter it and choose Continue.

If you do not have your phone, choose Use a recovery code, enter one of your recovery codes, and choose Continue.

Turning It Off

Choose Disable 2FA on the same screen, enter Your password, then choose Turn off 2FA to confirm. Asking for the password means somebody who finds your account signed in on a shared computer cannot switch the protection off. Signing in with your email and password stops asking for a code, and your recovery codes stop working. You can turn it back on at any time, with a new QR code to scan.

If You Lose Your Phone and Your Codes

If a federation is connected to your account, Sign in with Webpoint still works, because it never asks for a code. Once you are in, turn two-factor off from Settings → Two-factor auth (it asks for your password), then turn it on again to set it up on your new phone. If you have forgotten the password as well, reset it first (see below).

Otherwise, contact support.

Changing Your Password

Open Settings → Password, enter your Current password, then your New password twice, and choose Save. A Saved. message confirms it. A password needs at least eight characters; a long, random one is best.

If Your Account Has No Password

An account created by signing in through Webpoint has no password, and does not need one. Settings → Password says so, and does not ask for a current password: set one there and you can sign in with your email address and password as well. Connected accounts shows whether your account has one.

Only one account per email address can have a password. If several people share your address (a coach and the athletes they register, for example) and another of those accounts already has one, Settings → Password says so and does not set yours. Sign in to that account with its password instead, or contact support.

If You Forget Your Password

1. On the sign-in page, choose Forgot your password?
2. Enter your Email address and choose Email password reset link.
3. Open the email titled “Reset your BoutHost password” and choose Reset password. The link works for 60 minutes.
4. Enter your email address and your new password twice, and choose Reset password.

You are returned to the sign-in page with “Your password has been reset.” If two-factor is on, signing in still asks for your code.

An account with no password can use the same steps to get one, as long as it is the only account on that email address. If several accounts share the address and none of them has a password, the form answers “We can’t find a user with that email address.” Sign in with Webpoint instead, and set a password from Settings → Password.

If the sign-in page shows only Sign in with Webpoint, email-and-password sign-in is switched off for the moment, and Forgot your password? is not offered either.