Strong authentication

You can protect your BrewOS credentials with strong authentication. When it is enabled, signing in requires, in addition to your email address and password, a constantly changing one-time code (OTP) shown by an app on your smartphone. The method is standardised and is called a time-based one-time password (Time-based One-Time Password, TOTP).

Strong authentication is per user: it applies to your credentials on all accounts you have access to.

Enabling it is free of charge in BrewOS. If you choose a paid OTP app, its maker charges according to its own terms.

Enabling strong authentication

Install a TOTP-compatible app on your smartphone. Any app that supports the RFC 6238 standard will do, for example:
- Aegis Authenticator (Android)
- Google Authenticator (Android and iOS)
- Microsoft Authenticator (Android and iOS)
- 2FAS Auth (Android and iOS)
In BrewOS, open the My credentials page by clicking your name in the top right corner of the page.
Under Strong authentication, click the link Enable. A QR code appears.
Scan the QR code with the OTP app on your phone. The app starts showing a 6-digit code for BrewOS that changes every 30 seconds.
Type the code shown by the app in the field below the QR code. When the code is correct, the page refreshes and the status changes to Enabled. If the code changes before you finish, enter the next code.

When strong authentication is enabled, the My credentials page shows under Current OTP app value the code that the app on your phone should be showing right now. The value is fetched when the page opens and does not change by itself: reload the page if you want to compare a new code.

If the value shown on the My credentials page does not match the value your phone shows at the same time, you will not be able to sign in.

In that case, do not sign out; instead disable strong authentication (see below) and enable it again with the same or a different app. Also check that the time on your phone is correct, because the codes are based on the time of day.

Signing in with strong authentication

When you type your email address on the sign-in page, the page shows an OTP value field if strong authentication is enabled for your credentials. Type in it the code that the app on your phone shows at that moment.

BrewOS accepts only the code that is valid at that very moment. Most apps show how much time the code has left. If the code is about to change, wait for the new code before signing in.

A wrong code counts as a failed sign-in attempt in the same way as a wrong password: after five failed attempts, signing in is blocked for a while (see Security).

The same code is also asked when you sign in to BrewOS while connecting an AI agent.

Disabling strong authentication

Open My credentials.
Under Strong authentication, click the link Disable.
Confirm by pressing disable OTP.

Changing or losing your phone

If you change phones, disable strong authentication before giving up the old phone and then enable it on the new phone.

If you lose your phone, sign in via password reset: a sign-in link that does not ask for an OTP code is sent to your email. Once signed in, you can disable strong authentication and enable it again on your new phone. Password reset does not disable strong authentication automatically.

What strong authentication protects

Strong authentication protects signing in with an email address and password. Note, however:

The password reset link bypasses the OTP code. Whoever has access to your email can also get into your BrewOS credentials. So protect your email account well too.
If you choose Remember me in this browser when signing in, the same browser does not ask for a password or an OTP code for as long as the service is used in it at least every 14 days. Do not use this option on shared devices.