The mobile app's PIN or biometric lock protects access to the app on your phone. Multi-factor authentication in the browser adds a separate verification step when you sign in. These settings are managed in different places and do not replace your account password or the requirements of your organisation's sign-in service.
Locking the mobile app
First, sign in to the mobile app. On Android, open your profile using the person icon in the top bar. On iOS, you can open your profile using the person icon in the top-left corner of the Browse view. In your profile, select Security.
The PIN lock and biometric lock are alternative locking methods: enabling one disables the other. You can also turn both off. Your choice of locking method is saved locally in that app, so check the lock separately on each device you use. The PIN code itself is stored in your user details on the server.
Enable the PIN lock
- In the security view, turn on ACTIVATE PIN LOCK.
- The app retrieves and displays your current PIN code. Keep a record of the four-digit code for your own use and dismiss the notification. Activation does not ask you to create a new code.
- Check that the PIN lock switch is on and the biometric lock switch is off.
Enabling the lock requires a connection to the service to retrieve the current code. If retrieval fails, do not assume that the lock works just because the switch is on: check your connection and test opening the app.
Change your PIN code
In the same security view, select Change pincode on Android or CHANGE PIN LOCK on iOS. On Android, the option to change the code is shown when the PIN lock is enabled.
- Enter your current four-digit PIN code.
- Enter a new four-digit code and confirm it by entering the same code again. The codes 0000 and 1234 are not accepted.
- Wait for the notification Pin code changed successfully on Android or Pin changed successfully on iOS. The change is saved to the service, so you need an internet connection.
- Test unlocking the app with the new code.
Changing your PIN code does not change your account password. Because the PIN is part of your user details, the change also applies to the same user on other devices; the local setting that enables your chosen locking method remains separate.
Enable the biometric lock
In the security view, turn on ACTIVATE BIOMETRIC LOCK. Check that the biometric lock switch stays on and the PIN lock is disabled.
Android: the authentication dialog allows you to use the device's own PIN code, pattern or password as well as biometric authentication. A supported authentication method must be available on the device. Your phone's own PIN code is different from your Spotilla PIN code.
iOS: enabling the lock requires biometric authentication to be set up and available on the device. A device passcode alone does not meet this requirement. If the feature is unavailable, check your phone's authentication settings and the necessary permissions, or use Spotilla's PIN lock. If biometrics are later disabled in the device settings, Spotilla's biometric lock does not automatically switch to the PIN lock.
Check the lock and disable it if needed
Put Spotilla in the background, for example by opening your phone's home screen, then return to the app. The enabled locking method should ask for a PIN code or device authentication. Make sure that successful authentication opens the app.
To disable the lock, turn off the enabled locking method in the security view. When both switches are off, returning to the app does not prompt for this app lock verification. Disabling the PIN lock does not delete the user's saved PIN code.
Three incorrect PIN attempts trigger a logout. The Logout option on the PIN lock screen also provides a way to leave the lock screen. Logging out ends the app session and clears local session and cache data; it does not delete the user account or reset the PIN code.
If you cannot remember your PIN code, log out and then sign in again using your usual sign-in method. Do not assume that signing in creates a new PIN code. Check your current code when enabling the PIN lock and use the separate change option if you want to change it. If needed, see the sign-in and password reset instructions.
Multi-factor authentication in the browser
You need access to your own profile in the browser and an authenticator app that can scan a QR code and provide a changing six-digit authentication code. The on-screen instructions use Google Authenticator. Also choose a safe place for your backup codes that you can access without that phone.
Open the browser's user menu by the person icon and your name. Select User profile. In the Your profile form that opens, use the Multi-factor authentication section to manage authentication for your own user account.
Complete authentication activation
- Select Activate Multi-factor authentication.
- Scan the displayed QR code with your authenticator app. Keep the Spotilla authentication entry created in the app.
- Enter the six-digit code provided by the app and select Verify. If the code has expired or is incorrect, enter a new code displayed by the app.
- A valid code opens the Save backup codes view. Store all ten single-use backup codes securely somewhere other than just on your phone. You can use the Export to PDF button.
- In the backup code view, select Close and confirm that you have saved the backup codes. Only this confirmation activates multi-factor authentication.
Verify checks the code, and the PDF button saves the backup codes; neither completes activation on its own. Complete the setup in the same backup code view. If you cannot resume an interrupted setup, contact Spotilla support.
Check for the success notification Multi-factor authentication activated. In your profile, the activation button is replaced by Deactivate Multi-factor authentication. Do not share the QR code, authentication codes or backup codes with anyone.
If your organisation has made multi-factor authentication mandatory, the browser asks you to set it up before you can continue working.
Sign in with an authentication code or backup code
Log out and check the verification step the next time you sign in. When Multi-factor authentication in is required appears, enter the current code from your authenticator app and select Sign in.
Successful verification can be remembered in the same browser for 30 days, even after you log out. You may therefore not be asked to verify every time you sign in. You can check this in a separate private browser window that has no previously remembered verification.
If you cannot use the authenticator app, select Log in using backup code in the verification view. Enter one of your saved backup codes and select Sign in. At this step, the backup code replaces the authenticator app's code, not your password. A successfully used backup code becomes invalid immediately and cannot be used again. The view shows the number of backup codes remaining.
Incorrect authentication codes and backup codes increase the same failed-attempt count. Five failed verification attempts result in logout and deactivation of the user account. Successful verification resets the attempt counter. If you reach the attempt limit, contact your administrator. If you have lost both your phone and your backup codes, contact Spotilla support at helpdesk@spotilla.com.
Disable multi-factor authentication
In the Multi-factor authentication section of your profile, select Deactivate Multi-factor authentication. This removes the user's authentication setup and all associated backup codes, and resets the failed verification attempt counter. The old authenticator app setup and backup codes will no longer work for Spotilla verification.
Check for the notification Multi-factor authentication deactivated and the return of the activation button. Setting it up again requires scanning a new QR code and saving new backup codes. If your organisation requires multi-factor authentication, the deactivation button is disabled.
Additional authentication required by your organisation's sign-in service is a separate requirement. Follow that service's own instructions: changing Spotilla's mobile lock or browser profile settings does not remove the sign-in service's requirement.