Your Shokoofa account opens every Shokoofa app, so it is worth protecting well. The strongest simple step is two-step sign-in: besides your password you show something only you have.
Where you change your password and factors
Open My account → Sign-in and security. Every change (a new password, an authenticator app, a passkey) happens on the Shokoofa identity service's own pages: the account center sends you there and brings you back, with a short message saying whether it worked. The account center never sees your password or codes.
The second factors
- Authenticator app: an app on your phone, such as Google Authenticator, Microsoft Authenticator or FreeOTP, shows a new six-digit code every 30 seconds. To add one, choose Add an authenticator app, scan the QR code with the app and type the code it shows.
- Passkey: stored on your phone or computer and unlocked with your fingerprint, face or screen lock. There is nothing to type, and fake sign-in pages cannot trick it.
- Security key: a small hardware device (such as a YubiKey) you plug in or hold near your phone and touch.
- Recovery codes: one-time codes for the day you lose your phone or key. Create them once, then print them or keep them somewhere safe; each code works only once.
We recommend an authenticator app plus recovery codes, and a passkey if your device supports one.
Why administrators need, or should have, a second factor
Some actions are sensitive: granting an administrative role, suspending or deleting a tenant, changing security settings. Your organisation may require you to confirm your identity again with your second factor before them. This is called step-up confirmation. Where it is optional, Sign-in and security says so; a second factor is still recommended for administrators, because it stops someone who only has your password from signing in as you. When it is required, a dialog explains it; you confirm on the Shokoofa sign-in page and come back to the same page to repeat the action.
Step-up confirmation currently accepts the code of an authenticator app. If you hold an administrative role, add one before you need it.
Removing a factor
Choose Remove next to the factor and confirm. You then confirm the removal on the Shokoofa identity service's page. If it is your last second factor, two-step sign-in turns off; where step-up confirmation is required, sensitive administrative actions are then no longer possible until you add a new one.
If something looks wrong
If you see a sign-in method you did not add, remove it, change your password, and end the sessions you do not recognise under Sessions and devices.