Two-step sign-in (MFA)

You sign in to TrackParcel with the code we send to your address, or with Google; there are no passwords. Two-step sign-in adds a second check: a 6-digit code from an authenticator app on your phone. Someone who gets into your mailbox still can't get into your workspace.

Who needs it

• Owners and Admins must use it. It becomes required 7 days after you get the role. Until then a banner shows the date, for example “Owners and Admins sign in with an authenticator app from 19 Oct, 3:42 PM.” After that date you are asked to set it up before you can open the workspace.
• Members and Viewers can choose to turn it on for their own account.

Setting it up

1. Open your security settings. Go to Account → Security and choose to add an authenticator app.
2. Add TrackParcel to your app. Scan the QR code with an authenticator app such as Google Authenticator, Microsoft Authenticator or 1Password, or copy the secret into it.
3. Confirm. Enter the 6-digit code the app shows.
4. Add a backup. Add a second authenticator, for example on another phone or in a password manager. There are no printable recovery codes, so a second authenticator is your way back in if you lose the first.

Codes come only from an authenticator app; TrackParcel doesn't send codes by text message.

When you are asked for a code

When you sign in, and again before the actions that matter most, if your current session hasn't used the code yet:

• creating, rotating or archiving an API key, revealing a webhook secret, or sending your customers' contact details to a webhook;
• transferring ownership or closing the workspace;
• exporting data, the workspace's or your own;
• deleting your account, or changing the address you sign in with;
• the billing pages, and your workspace's business details;
• changing someone's role, or removing them from the workspace;
• erasing your customers' details from shipments;
• letting TrackParcel support view the workspace.

Sessions and new sign-ins

• Account → Security lists where you are signed in, with the device or browser, approximate location and when it was last used. Sign out of one session, or choose “Sign out of all other sessions”.
• Owners and Admins see a notice in the app, “New sign-in to your account”, for every new sign-in, with the browser and the time, so a sign-in they don't recognise stands out. It appears in the bell of each workspace where they are an Owner or Admin.

If you lose your phone

Use your backup authenticator if you added one. If not, contact support (from the app (Help → Contact support) on Starter and above, or write to support [at] trackparcel.in on any plan). We check it is really you: you sign in with the code we send to your address, and for an Owner or Admin another Owner or Admin of the workspace confirms it to us, or we check a business document such as your business registration certificate, or hold a short video call. Every Owner and Admin of your workspaces sees a notice in the app and can ask support to cancel the reset. It happens no sooner than 72 hours after the request, and for 72 hours after it the actions in the list above stay blocked.

Who has which role is explained in Team and roles.