Setting up Two-factor authentication (2FA)

To add another layer of security to your Breww account, you can require that all users have 2-factor authentication (2FA) enabled, meaning that users will need a one-time code every time they log in, or an individual user can set this up to apply to their user login only.

Require 2FA for all users

A brewery admin can access this by heading to Settings -> Users & security settings. At the bottom, you will see a section called Security settings, giving the option to mark Require all users to have two-factor authentication enabled. Check this box, and all users registered to the brewery account will now require a one-time code through an authentication app.

Users will be asked to scan a QR code with a 2FA token generator of their choice. We recommend Google Authenticator or Authy (but we're compatible with most apps of this nature). Once you have scanned this, it will present a one-off token to type in.

Until a user has set 2FA up, they won't be able to use the rest of Breww; every page will send them back to the setup screen, and the screen explains that an administrator has made this a requirement.

Note: Breww needs a verified email address on the user's account before 2FA can be switched on. If a user has an unverified address, they'll be sent to Manage email addresses first, where they can use Re-send verification email and click the link that arrives. This protects the account, as it makes sure 2FA can only be added by someone who can actually receive email at that address.

This will enable you to access your account. Once in, there will be an option to generate recovery codes. Recovery codes can be used instead of regular tokens generated using your authentication app. If you lose your phone and cannot load the standard time-based codes, a recovery code can be used to get back into your Breww account and re-set up 2FA on your new device. Each code can only be used once, so keeping these safe is essential! You can also download them to keep them somewhere safe, and generate a fresh set at any time (which invalidates the old ones) if you think someone else may have seen them.

Set up 2FA on an individual user profile

You also have the ability to give the user a choice of whether they want 2FA on their user profile. They can do this by heading to their profile icon on the top right of the screen and selecting Profile, or by going to Settings -> Personal user account settings. From there, choose Set up two-factor authentication and follow the above principles. Once it's enabled, the same option reads Manage two-factor authentication and takes you to your recovery codes.

Passkeys

As well as (or instead of) an authenticator app, you can add a passkey to your account. A passkey lets you sign in using your device rather than typing a password, for example with your fingerprint, your face, your device PIN, or a physical security key.

Passkeys are managed under Settings -> Personal user account settings -> Manage passkeys, or from the same button on your profile page. The page lists any passkeys already on your account, showing when each was created and last used, with a button to remove ones you no longer want. Click Add passkey to add another, then follow the prompts from your browser or device. It's worth adding one for each device you regularly use Breww on.

Turning off 2FA

If you currently have 2FA set up, but would like to turn this off, you can head to the 2FA page from your profile and select Disable two factor authentication. If an admin has set to require all users to have 2FA enabled, an individual user will not be able to override this, and the admin would have to follow the steps under Require 2FA for all users, and uncheck the box.

As this is a sensitive change, Breww will ask you to confirm that it's really you before it goes through, by re-entering your password or a code from your authenticator app.

If a team member loses access to their 2FA device

A brewery admin can clear 2FA from a colleague's account so they can log back in with just their password. Go to Settings -> Users & security settings, click the user, and use the Clear 2FA button on their page. If you have the brewery-wide requirement switched on, they'll be prompted to set 2FA up again the next time they load a page or log in.