The new DrillerDB is out of beta.See what's new

Security & Multi-Factor Authentication

Turn on multi-factor authentication for your account, sign in with a code, manage passkeys and backup codes, and require MFA for your company.

Security & Multi-Factor Authentication

Multi-factor authentication (MFA) asks for a second proof after your password: a 6-digit code from an authenticator app, a passkey, or a one-time backup code. Even if someone learns your password, they cannot sign in without it.

Where you set each method up:

MethodSet it up in
Authenticator app (6-digit codes)The console or the classic app
Passkey (fingerprint, face, PIN or security key)The classic app at app.drillerdb.com
Backup codesThe classic app

Quick Start: Turn On MFA for Your Account

  1. In the console, open your user menu and click Security & MFA. The My Security page opens.
  2. On the Your Authenticator App card, click Enable Authenticator App.
  3. Under Step 1: Scan this QR code, scan the code with an authenticator app such as Google Authenticator or Authy. If you cannot scan it, type the Manual entry key into the app instead.
  4. Under Step 2: Enter the 6-digit code, type the code the app shows now.
  5. Click Verify and Enable.

The card shows "Authenticator app enabled. You will be asked for a code at your next sign-in." and its badge changes from Not set up to Enabled.

Get backup codes from the classic app

Setting up the authenticator app in the console does not create backup codes. Without them, a lost phone locks you out until an admin resets your MFA. After you enable MFA, sign in to the classic app, open Security, and use Regenerate Codes to get 10 codes. Keep them somewhere other than your phone.

Signing In with MFA

On the console

  1. Sign in with your email and password, or with Continue with Google.
  2. The Two-Factor Authentication screen asks for the 6-digit code from your authenticator app.
  3. Type the code and click Verify.

If your phone is not with you, click Use a backup code instead and type one of your backup codes. Each code works once.

If the only method on your account is a passkey, the console cannot finish the sign-in yet. It says "This account requires a passkey. Please sign in on the classic app for now." Sign in at app.drillerdb.com instead.

On the classic app

  • With an authenticator app: enter your email and password, then the 6-digit code.
  • With a passkey: click Sign in with Passkey and follow your device's prompt (Touch ID, Face ID, Windows Hello, a PIN or a security key).

If Your Company Requires MFA and You Have None

When an admin has enforced MFA and your account has no method yet, the console does not stop you at sign-in. After your password (or Continue with Google) it shows a setup screen that says your company requires two-step verification.

  1. Scan the QR code with an authenticator app such as Google Authenticator or Microsoft Authenticator.
  2. Type the 6-digit code the app shows and click Verify and Continue.
  3. Copy your backup codes. They are shown only once. Click I Saved These Codes, Continue to go on to the console.

If the codes cannot be loaded, the screen says to create them in Settings > Security.

Step-by-Step: Passkeys and Backup Codes (Classic App)

In the classic app, open your profile menu and click Security. The window shows your MFA status and one section for each method.

Authenticator App (TOTP)

  • Set up Authenticator App adds an authenticator app. When setup finishes, the classic app shows your backup codes.
  • Remove Authenticator App turns the codes off for your account.

Passkeys

Passkeys sign you in with your device's biometrics, PIN or security key.

  1. Click Add Passkey.
  2. Follow your browser's prompt to create the passkey on this device.

The table lists each passkey with its Name, Created and Last Used dates. To remove a passkey from a lost or replaced device, click the delete button on its row and confirm Delete Passkey?. That passkey can no longer sign in.

Backup Codes

Backup codes become available after MFA is on. The section shows Remaining codes.

  • View Codes shows your current codes.
  • Regenerate Codes creates 10 new codes and cancels every old one at once.

Danger Zone

Disable Multi-Factor Authentication removes every MFA method from your account. You confirm with a code from your authenticator app.

Turn Off the Authenticator App (Console)

  1. Open Security & MFA from your user menu.
  2. On the Your Authenticator App card, click Disable.
  3. In Disable Multi-Factor Authentication, type the current code from your authenticator app.
  4. Click Disable MFA.

This removes the authenticator app from your account. If your company requires MFA, set it up again right away.

Require MFA for Your Company (Admins)

Only admins can open Settings > Security in the console.

The Multi-Factor Authentication card shows:

  • A badge that reads Optional or Enforced.
  • Active Users, MFA Enabled and Coverage, plus an MFA adoption bar that counts users with MFA on.

To require MFA:

  1. Check that Coverage reads 100%, so every active user already has MFA on.
  2. Click Enforce MFA. The change applies at once, and the card reads "MFA is required for all users".

To go back to optional, click Make Optional and confirm Make optional in the Make MFA optional? dialog.

Below that card, Your Authenticator App is the same card as on My Security, and Supported Authentication Methods lists Authenticator App (TOTP) and Passkeys / Security Keys.

Any user without MFA is asked to set it up at their next sign-in (see above). Ask users to follow the Quick Start first so nobody is surprised, and check Coverage before you click Enforce MFA.

Account Recovery

You lost your phone but have backup codes

  1. Sign in to the console with a backup code: click Use a backup code instead on the Two-Factor Authentication screen.
  2. In the classic app, open Security, click Remove Authenticator App, then Set up Authenticator App with your new phone.
  3. Use Regenerate Codes if you used several codes.

You have no way to sign in

Ask an admin at your company to reset your MFA. In the classic app, the admin opens Manage Users from the profile menu, clicks the Users & Access tab, and clicks the Reset MFA for this user button (a lock icon) on your row, then confirms Yes, reset MFA. The button appears only for users who have MFA on. After the reset, set MFA up again as soon as you are signed in.

If you are the only admin, contact support@drillerdb.com.

Session Lifetime (Current Defaults)

  • Web sessions: 7 days
  • Mobile sessions: 90 days

Changing or resetting a password ends every session of that account that started before the change, on the web and in the field app. The same happens when an admin sets a new password for a user.

Security Best Practices

  • Use an authenticator app as your main method, and keep backup codes on paper or in a password manager.
  • Add a passkey in the classic app for each computer or phone you sign in on often.
  • Use a long password that you do not use anywhere else. A password manager makes this easy.
  • Lock your devices when you step away, and do not sign in on shared or public computers.

Troubleshooting

Authenticator code not accepted

  • Check that your phone's clock is set automatically. Codes depend on the time.
  • Make sure you are reading the DrillerDB entry in your authenticator app.
  • Codes change every 30 seconds. If one just changed, type the new code.

Passkey not working

  • Passkeys work only on the classic app today.
  • Try another browser, or check that your device's fingerprint or face sensor works.
  • If you deleted that passkey, sign in another way and add it again.

Locked out

  • Try a backup code first.
  • With no backup codes, ask your company admin to reset your MFA.

Support

Security questions? Email support@drillerdb.com.

Related Topics