Signing in with a password, and two-factor authentication

Who can use it. Everyone with a Summit Hub account: customers, field accounts, employees, owners, and platform overseers. Password sign-in is an optional extra some businesses may not have turned on yet; two-factor authentication ("2FA") is available to everyone and is required outright for platform overseers.

What it's for

Signing in with an emailed link works well, but some people would rather use a password, especially on a shared or slow-to-check inbox. When your business has password sign-in turned on, you can set one up and use it instead of waiting for an email every time. Two-factor authentication adds a second, much stronger layer of protection: even if someone guessed or stole your password, they still couldn't get into your account without the six-digit code from your authenticator app (or a saved recovery code).

How to use it

Setting a password

1. Go to My Account, in the sidebar for every signed-in role.
2. If you don't have a password yet, the Password card offers Set password: choose one (10 to 128 characters, no other rules) and confirm it.
3. Once you have a password, the same card becomes Change password, which asks for your current password first.
4. Either way, you'll see a "Password updated" confirmation once it's saved.

If your business hasn't turned password sign-in on yet, the sign-in page only offers the emailed-link option. That's expected, not a fault.

Forgot your password?

1. On the sign-in page, switch to "Use a password instead", then click Forgot password?
2. Enter your email and submit. You'll always see the same "check your email" message, whether or not that address actually has an account, so nobody can use this form to find out who has one.
3. If an account exists, you'll get an email with a link. It's single-use and expires after 60 minutes.
4. Opening the link lets you choose a new password. This also works as a way to set your FIRST password, if you've never had one.
5. Once it's saved, sign in as normal. You'll go through the same two-factor check as any other sign-in if you have it turned on.

Setting up two-factor authentication

1. Go to My Account and find the Two-factor authentication card.
2. Click Set up two-factor authentication.
3. Scan the QR code with an authenticator app (Google Authenticator, 1Password, Authy, and similar all work), or type in the code shown underneath if you can't scan.
4. Enter the 6-digit code your app shows to confirm it's linked up.
5. You'll be shown 10 recovery codes: save these somewhere safe. Each one can be used once, instead of your authenticator app, if you ever lose access to it. They're only ever shown this one time.

From then on, every time you sign in, whether by emailed link or password, you'll be asked for a 6-digit code (or a recovery code) before you're fully signed in.

On the verification screen, type or paste your code into the six digit boxes, then select Verify (or press Enter). You can use your keyboard to edit the code or tap a digit to replace it. If you cannot access your authenticator, choose Use a recovery code instead to enter a saved recovery code.

Losing access to your authenticator app

Use one of your saved recovery codes in place of the 6-digit code on the verification screen. Once you're back in, go to My Account and regenerate your recovery codes. This replaces your whole set with 10 fresh ones (shown once, same as at setup) and immediately invalidates the old ones, including the one you just used.

If you've lost your authenticator app and your recovery codes, contact whoever manages your Summit Hub account for help. This needs an operator to step in.

Turning two-factor authentication off

From My Account, click Disable two-factor authentication and confirm with a current code (or a recovery code). This option isn't offered at all if your role requires 2FA (see below). In that case there's no way to turn it off short of no longer needing the requirement.

How long you stay signed in

Summit Hub keeps you signed in on each device so you don't have to sign in every visit, with two limits:

• If you don't use Summit Hub on a device for 14 days, you're signed out there.
• However often you use it, every sign-in lasts at most 30 days. After that you're sent to the sign-in screen and asked to sign in again, the same way you normally do.

This is the same for everyone: customers, field accounts, employees, owners, suppliers and platform overseers, whether you sign in with an emailed link or a password. It limits how long a lost phone or a forgotten shared computer stays signed in to your account.

When your sign-in has expired

If you open a Summit Hub link — a deal someone sent you, a bookmark, a page you left open overnight — and your sign-in is no longer valid, you'll be taken to the sign-in screen. Sign in as usual and Summit Hub puts you straight back on the page you were trying to open, so you don't have to find it again.

Previously some pages showed an error screen instead, which left you to navigate back to the app and then find the page yourself.

What it affects

• The sign-in page, when password sign-in is turned on for your business.
• How long a sign-in lasts: 14 days without use, and never more than 30 days in total.
• Any page opened with an expired sign-in: you're sent to sign in and then returned to that page, rather than shown an error.
• Every sign-in, once you've turned on two-factor authentication: you'll see an extra verification step after your usual sign-in method.
• My Account, a new page in the sidebar for every role, with the password and two-factor cards described above. On a wide screen your profile and notification emails sit in the left column and your password and two-factor cards in the right; each column stacks on its own, so a short card never leaves a gap under it. On a phone the cards run one after another.
• Employees and owners who haven't set up 2FA see an occasional reminder banner suggesting they do. It can be dismissed and comes back after a day.

Good to know

• Password sign-in is optional on top of the emailed link, never a replacement for it: you can always fall back to the emailed link.
• Two-factor authentication is required, with no way to opt out, for platform overseers. For everyone else it starts as an encouraged, optional extra, though a business can choose to require it for its employees and owners too; if so, they'll be asked to set it up the next time they sign in and won't be able to use the app until they do.
• Customers and field accounts can turn 2FA on if they'd like the extra security, but it's never required for them, and they won't see the reminder banner.
• Platform overseers can set a password and turn on two-factor authentication from My Account the same as anyone else, even though they are not a member of any business. This used to fail for an overseer with no assigned business and is now fixed.
• A changed or reset password signs out any OTHER devices/browsers you were signed into elsewhere, within a few minutes. The device you just changed it from stays signed in.
• Setting, changing, or resetting your password also cancels any other "reset your password" email link you'd previously requested but not used. Only the most recent action wins.
• Each code from your authenticator app works once. If you need to verify twice in a row (for example signing in, then regenerating recovery codes), wait for the app to show the next code.
• Recovery codes are 16 characters long, in four groups. If yours are the older 8-character kind, they still work, but regenerating them gives you a stronger set.
• Recovery codes are shown to you exactly once. If you didn't save them, use Regenerate recovery codes in My Account (this needs your authenticator app or an existing recovery code) to get a fresh set.
• When your role requires two-factor authentication, downloads of sensitive documents and exports wait for the same verification step as the rest of the app. Finish verification, then retry the download.
• While an owner is viewing the app as another user, that user's My Account page shows a notice instead of the Password and two-factor cards. Only the account owner can set or change their own password or two-factor settings.