Your Bokko account protects business and guest data, so sign-in hygiene matters. The dashboard supports email/password and Google sign-in. The Settings → Security section has three blocks: Password, Two-factor authentication and Sessions. If two-factor authentication is on, Bokko asks for your authenticator code when you sign in to the dashboard and for some sensitive account actions.
- 1. Change password here — Change
- 2. Two-factor authentication — Set up
- 3. Sign out from all devices
How sign-in works
- Email and password sign-in is supported.
- Google sign-in is supported.
Manage your password from the dashboard
- Change your password — With an email/password account, use the Change button in the Change password here row. The dialog always asks for your current password, and you enter the new one twice.
- Password reset email — With an email/password account, the Send password reset email button in the Reset password via email row emails a reset link to the address linked to your account.
- Google sign-in — With Google sign-in these two rows are not shown. Instead you see Password managed in your Google account: change your password in your Google account.
Two-factor authentication (TOTP / 2FA)
Use the Set up button in the Two-factor authentication block to turn on authenticator-app (TOTP) verification, for example with Google Authenticator, 1Password or Authy. If you signed in more than 5 minutes ago, Bokko first asks you to confirm your identity again (with your password or in the Google window). Then you scan the QR code (or enter the key), enter the 6-digit code, and finally receive your backup codes. Bokko shows the backup codes only this once, so copy or download them. Once it is on, Bokko asks for your current code before deleting your account and before cancelling a deletion request. With two-factor authentication on, the dashboard asks for a code too: after sign-in the Two-step verification screen appears, where you enter the 6-digit code from your authenticator app or a backup code. It is valid for at most 12 hours, is not extended while you work, and then Bokko asks again. Turning two-factor authentication off, replacing your authenticator app and Sign out everywhere also end it.
- 1. Code field — the 6-digit code from your authenticator app or a backup code
- 2. Continue
Revoke active sessions
In the Sessions block, the Sign out everywhere button in the Sign out from all devices row invalidates all active sessions. In the confirmation dialog you type SIGN OUT. You are signed out on this device immediately; other devices have to sign in again at their next authentication check. If you lose a device or notice suspicious activity, start here and then change your password.
When does Bokko ask for confirmation?
These actions ask for an extra confirmation even when you are already signed in:
- Changing your password: your current password.
- Turning on two-factor authentication: reauthentication if you signed in more than 5 minutes ago.
- Turning off two-factor authentication: your current authenticator code (or a backup code), and typing the confirmation word.
- Deleting your account and cancelling a deletion request: typing the confirmation word, plus your current code if two-factor authentication is on.
Security tips
- Do not share your sign-in credentials with others.
- Use a unique, strong password if you sign in with email and password.
- Enable TOTP-based two-factor authentication under Settings → Security.
- Protect your Google account as well (strong password + 2FA) if you use Google sign-in.
- If you notice suspicious access: revoke all sessions, change your password, and contact support.