# Sign-in and security How you sign in to SendBeam, how to reset a password, and how to protect the account with an authenticator app. One SendBeam login can hold several workspaces, so your sign-in details belong to *you* rather than to any one workspace. This page covers signing in, resetting a forgotten password, and adding a second step with an authenticator app. All of it lives under **Account settings → Security**, reached by clicking the account name at the foot of the sidebar. ## Signing in Go to the sign-in page and enter the email address you registered with. SendBeam then offers two ways to prove it is you: - **Your password** — type it and click **Sign in**. - **A one-time link by email** — click **Email me a one-click sign-in link** and SendBeam sends a sign-in link to that address. Open it and you are signed in, without typing a password. Useful on a machine where you do not want to type one, and the way back in if your password manager is on the other device. Signing out is a button in the sidebar, under your account name. ### If you forget your password 1. On the sign-in page, click **Forgot password?**. 2. Enter your email address and click the button. SendBeam emails you a six-digit code. 3. Type that code on the page that is waiting for it, along with the new password you want (at least 8 characters), and save. 4. You are told the password has been updated, and can sign in with it straight away. The code is sent to the address on the account and nowhere else, so keep access to that mailbox. If the email does not arrive, check the spam folder and ask for another one. ## Passkeys A passkey signs you in with your face, fingerprint or device PIN. There is no password to type or leak and no code to copy, and a passkey only ever works on sendbeam.io, so a look-alike site gets nothing. It is the sign-in we recommend. Add one under Settings → Security → Passkeys. Your device offers to save it in iCloud Keychain, Google Password Manager, Windows Hello or a password manager, and from then on the sign-in page offers it in the email field, or through "Sign in with a passkey". A passkey counts as two factors, so a sign-in with one is never asked for an authenticator code. On a device that does not hold the passkey, your phone can present it by QR code, or a sign-in link to your email still works. Rename or remove passkeys on the same page. ## Two-factor authentication Two-factor authentication (2FA) asks for a six-digit code from an app on your phone in addition to your password, so that knowing the password is not enough to get into the account. SendBeam uses the standard authenticator (TOTP) method, which works with Google Authenticator, 1Password, Authy, or any other app that shows a rolling six-digit code. It is optional, and we recommend it for anyone who can send email to your audience. ### Setting up an authenticator app 1. Open **Account settings → Security** and click **Set up authenticator**. 2. Scan the QR code with your authenticator app. If you cannot scan — the app is on the same device, say — use **Can't scan?** and type the key shown beside the code into the app by hand. 3. The app starts showing a six-digit code for SendBeam. Enter the current one and click **Verify and switch on**. 4. The Security page now shows **On**. If the code was not accepted, a fresh QR code is offered so you can try again — an authenticator that is a little out of step usually just needs its clock set to update automatically. ### Signing in once it is on After your password, SendBeam asks for the code from the app before it lets you in. Open the app, read the current six digits and enter them. The same screen offers **Sign in as a different user** if you reached it with the wrong account. ### Turning it off On the Security page, enter the code your app is showing *now* and click **Remove**. The current code is required on purpose: taking the second step off is exactly what someone who had stolen a session would want to do, and asking for the code means they cannot. You are asked to confirm, and can enrol again at any time. ### If you lose the device Get in touch through the [contact form](https://sendbeam.io/contact?s=support) and we will help you back into the account; then you can set the authenticator up again on the new device. ### Trusted devices When you enter a code, the challenge page offers to trust that browser for 30 days. Tick it on your own phone or laptop and that browser is not asked for a code again, even after you sign out and back in. Leave it unticked on a shared or public computer. Every remembered browser is listed under Settings → Security → Trusted devices, with when it was added and last used. Forget any one of them, or all of them, at any time. They are all forgotten automatically when you change your password or add or remove an authenticator, and a browser is asked for a fresh code if it turns up from a different country. Trust runs out 30 days after the day it was given, whether or not the browser is used in between. The platform console for SendBeam staff never uses trusted devices; it asks for a code on every session. ## Whose settings these are Security is part of **account** settings, not workspace settings, and it only ever shows your own sign-in. A workspace admin cannot see, change or switch off another person's password or authenticator — not from the Team page and not from anywhere else. What an admin can do is take someone's access to the workspace away: see [Team management](https://sendbeam.io/docs/admin/team#managing-your-team). ## Roles and what they can change Each workspace has three roles: **owner**, **admin** and **member**. Admins can do everything members can, plus manage the team, sender details and sending domains, API keys, webhook endpoints and the workspace export. The owner — exactly one per workspace, holding an admin seat — is additionally the only person who can delete the workspace, change the account's plan or open the billing portal, and can transfer ownership to another member. Roles are per workspace, so the same login can be an admin in one workspace and a member in another. None of those roles reaches your sign-in. Your password and your authenticator are yours in every workspace you belong to, and they follow your login when you are invited to another one. See [Team management](https://sendbeam.io/docs/admin/team) for what each role can do, and [Settings and workspaces](https://sendbeam.io/docs/admin/settings) for the rest of the settings. --- Source: https://sendbeam.io/docs/admin/security