14 — Account security
← Handbook · Previous: Team members and what they can do · Next: Emailing ticket holders
What it is
One COME TOGETHER account works everywhere: buying tickets, running events, and signing in to the scanner app. This chapter covers signing in, passwords, and two-step verification, for you and your team.
Signing in
You can sign in two ways:
- With your password, or
- With an email link. On the sign-in page, choose Email me a link. We email a button that signs you in. It works once, for 15 minutes, and only the newest link works if you ask more than once.
Opening the email doesn't sign you in by itself. You press the button on the page it opens.
Remember me keeps you signed in on that device for up to 30 days.
Forgot your password?
- On the sign-in page, choose Email me a link and enter your email.
- Open the email and press Sign in.
- Go to Account → Change password. Straight after signing in with a link, you don't need your old password.
Changing your password signs you out everywhere else.
Where you're signed in
Account → Security lists the devices you're signed in on, with roughly where and when each was last used. Choose Sign out next to one you don't recognise, or Sign out everywhere else. Any device that was remembering you will need to sign in again too.
Your buyers' accounts
Anyone who buys tickets gets an account automatically, even if they never create a password. They can sign in at any time with an email link to see their tickets, send them to a friend, or set a password.
If someone tries to sign up with an email that already has tickets on it, they're sent to sign in with a link instead.
Two-step verification
Two-step verification adds a code from an authenticator app (like Google Authenticator or 1Password) every time you sign in, including with an email link and in the scanner app.
Turn it on from Settings → Security: scan the code with your app, enter the 6-digit number, and save the recovery codes somewhere safe. Each recovery code works once, for when you don't have your phone.
We strongly recommend it for owners and admins, who can see every order and payment.
A few wrong codes in a row pauses sign-in for that account for a few minutes. After entering your password, you have 10 minutes to enter the code.
Turning it off or making new recovery codes asks for your password.
Your organization's contact email
Changing your organization's contact email sends a confirmation link to the new address. It only changes once that link is used, within 24 hours.
Until a contact email is confirmed, notices about your organization go to the owner's sign-in email. The Contact tab shows which address is being used.
Good to know
We never email a password, and nobody from COME TOGETHER will ask for yours or for a sign-in link.
If you didn't ask for a sign-in link, ignore the email. Nobody can use your account without opening it.
New accounts get a confirmation email. Some things connected to your email, like promoter links an organizer set up for you, appear once you've confirmed it.