Two-factor authentication & SSO

Two-factor authentication (2FA)#

TrackCrown uses time-based one-time codes (TOTP, RFC 6238) from any authenticator app: Google Authenticator, Microsoft Authenticator, 1Password, Authy and others.

Turn on 2FA#

1. Open your profile: user menu → Profile (https://app.trackcrown.com/app/profile). Platform administrators use https://app.trackcrown.com/admin/account.
2. In Two-factor authentication (row Authenticator app), click Set up 2FA. The dialog Set up two-factor authentication shows a QR code.
3. Scan it with your app. If you cannot scan, copy the key from Can't scan? Enter this key manually.
4. Enter the 6-digit code the app shows and confirm.
5. Save your recovery codes (next section).

From now on a code is required whenever you sign in on a new session. The secret is stored encrypted.

Recovery codes#

The Recovery codes card gives you 10 one-time codes. If you lose your authenticator, enter one of them instead of the 6-digit code at sign-in. Each code works once.

• The card shows how many codes remain and warns when you are Running low or have None.
• Generate new codes replaces the whole set: every earlier code stops working immediately. The new codes are shown once — copy or download them and keep them in a password manager.

Turn off 2FA#

Click Turn off, then confirm with your Password and a current 6-digit code. If your workspace requires 2FA for staff, you will be asked to enrol again before you can continue.

Require 2FA for staff#

Admins and owners: Settings → Workspace → Security → Require two-factor authentication for staff.

• Applies to owner, admin, manager and analyst. Partners and advertisers keep 2FA optional.
• On by default in production workspaces.
• A staff member without 2FA is kept on their profile page and every staff action is refused with "Set up two-factor authentication on your profile page before continuing." until they enrol.
• Settings → Users shows how many active members still have no 2FA.

Platform administrators have their own policy for admin accounts, also on by default in production.

Lost access#

If a team member has lost both their authenticator and recovery codes, a platform administrator can use Reset two-factor sign-in on the user under Admin → Users. The user then signs in with their password and enrols again.

Single sign-on (SSO)#

Users can sign in with Google, Microsoft Entra ID or any other OpenID Connect provider. SSO signs in existing accounts by verified e-mail address; it does not create accounts. Users with 2FA still enter their code after SSO.

Set up a provider (platform administrators)#

SSO is configured per brand at Admin → Single sign-on (https://app.trackcrown.com/admin/sso).

1. In your identity provider, create an OAuth/OIDC client with this redirect URI (shown on the page for each provider):

https://app.trackcrown.com/auth/sso/google/callback
https://app.trackcrown.com/auth/sso/microsoft/callback
https://app.trackcrown.com/auth/sso/oidc/callback

2. In TrackCrown, fill in the provider's form:

3. Save, then sign in once with a test account. Removing a provider sends users back to password sign-in (unless a workspace enforces SSO).

Require SSO for a workspace#

Admins and owners: Settings → Workspace → Single sign-on → Require single sign-on for members. Password sign-in is then refused for members of that workspace; platform administrators keep password sign-in as a fallback.

Sign-in security summary#