# Two-step sign-in, app lock & devices

Turn on 2FA, lock the app with a PIN, and see or log out every device signed in to your account.

Source: https://about.sukbay.com/docs/devices-sessions · Part of the Sukbay documentation (Account & app).

Open **Settings › Security & 2FA** to protect your shop. There are three layers: two-step sign-in, app lock and device management.

## Two-step sign-in (2FA)

1. **Press Enable 2FA.** A QR code appears.
2. **Scan it.** Use Google Authenticator, Authy or 1Password. Also save the **backup secret key** somewhere safe.
3. **Enter the 6-digit code.** Type the code the app shows to confirm.
4. **Sign in with it.** From now on, after your password (or Google sign-in) Sukbay asks for the 6-digit code.

To turn it off you must enter your password and a current code, so nobody else can switch it off.

## App lock

- In the **mobile app** set a PIN (and Face ID or fingerprint if your phone has it). The app locks when you leave it and when you press Lock.
- On the **web dashboard** press the **Lock** button at the top when you step away; it asks for your PIN to continue.
- You are not asked for the PIN right after typing your password: the lock only appears when you come back.

## Active devices & sessions

The **Active Devices & Sessions** card lists every device signed in to your account.

- Each row shows the device (for example *Chrome on Windows*), the **place** it signed in from, the IP address, the internet provider and when it was last active.
- The place is **estimated from the IP address**, so on mobile data it can be the provider's location rather than the exact street.
- Your own device is marked **Current Device**.
- **Log Out** ends one other device. **Log Out All Other Devices** ends them all.
- Two devices with the same browser and system (two Windows computers on Chrome) show as two rows, because each browser keeps its own device ID.

## Other accounts (owner and managers)

The **Other accounts** card lists your staff and any other owners of the shop. For each person it shows their role, their warehouse, and the device, place and time of their **last sign-in**. A coloured dot shows whether they are online now, signed in today or have not signed in lately.

## Auto logout

In Settings › General turn on **Auto logout** so a session that is left idle closes itself.

> **Warning:** If a phone is lost, open Active Devices from another device and press Log Out on it, then change your password.