Two-factor authentication (2FA) asks for a second proof, besides your password, each time you sign in. Single sign-on (SSO) lets your team sign in through your company's identity provider. Anyone can turn on 2FA for their own account. Requiring 2FA for everyone and setting up SSO are for managers and need an add-on.
Turn on 2FA for your account
Go to Settings, then Account. Under Preferences, for 2FA you have two options. You can use one or both.
*Email code*
Switch on "Two-factor authentication (2FA)". It adds a one-time code, sent by email, when you sign in.
Select "Send code". We email a 6-digit code to your address.
Enter the code, select "Verify code", then select "Finish".
If the code is wrong, you see "That code didn't match. Request a new one." Use "Request new code" to get another. To turn it off, switch the toggle off and confirm with "Disable 2FA". This only turns off the email code. If you also set up an authenticator app, you still need it to sign in. Use "Remove app" to turn that off.
*Authenticator app*
Next to "Authenticator app", select "Set up". We email you a code first. Enter it to continue.
Scan the QR code with 1Password, Google Authenticator, or a similar app. If you can't scan it, select "Copy key" and enter the key in your app.
Enter the 6-digit code your app shows, then select "Verify code". Finish within 15 minutes of starting.
Save your recovery codes. You get 10, and each one signs you in once if you lose your app. They aren't shown again, so select "Copy codes" and keep them somewhere safe, then select "Done".
Once it's set up, the row shows "Enabled" with a menu:
Replace app: switch to a new phone or app.
New recovery codes: creates a fresh set. The old codes stop working.
Remove app: turns off the authenticator app.
Each of these asks for a code from your current app, or one of your recovery codes. We also email you "Your Ocean.io sign-in settings changed" when an app is added, replaced, or removed, or when you get new recovery codes. If it wasn't you, the email links to a password reset.
Signing in with 2FA
Enter your email and password as usual. The "Verify your identity" screen opens.
With an authenticator app, you're asked for the code from your app first.
With only email 2FA, we email you a code. It's valid for 30 minutes and works once.
If you have an authenticator app, you can switch with "Use your authenticator app" or "Use a recovery code". If you also turned on email 2FA, you can choose "Email me a code instead".
A recovery code looks like xxxx-xxxx-xxxx. Each one works once.
Failed codes count toward the same limit as wrong passwords: after 5 failed attempts in a short time, sign-in is locked for 5 minutes.
2FA is separate from the code Ocean.io sends when you sign in from an unfamiliar device. With 2FA on, you're asked for your second factor every time you sign in with a password, and "Trust this device and network" doesn't skip it. See "Signing in: login codes and trusted devices". If you use "Sign in with Google", 2FA still applies. Sign-in through your organization's SSO doesn't ask for an Ocean.io code.
Require 2FA for your organization (managers)
A manager can require 2FA for everyone in the organization.
Go to Settings, then Security.
Switch on "Two-factor authentication (2FA)". It requires everyone in your organization to sign in with a code from an authenticator app or sent by email.
Confirm "Require two-factor authentication?" with "Require 2FA".
Anyone without a second factor sees a dialog that they can't close. It says "Your administrator requires this for your organization". They choose "Send code by email" or "Use authenticator app" to finish setup. After that, a person who set up email 2FA can't switch it off on their own, unless they also set up an authenticator app.
To stop requiring it, switch the same toggle off and confirm "Disable 2FA". People keep the 2FA they already set up and can turn it off in their own settings.
Single sign-on (SSO)
SSO adds your identity provider as a sign-in option for everyone in your organization. It uses OpenID Connect (OIDC). The setup dialog has presets for providers such as Okta, Microsoft Entra ID, Google Workspace, JumpCloud, and Auth0. Choose "Custom / other" for any other OIDC provider.
*Who can set it up, and what it needs*
Only managers can set up SSO. It's part of the Enterprise security add-on, together with required 2FA and per-user credit limits. To add it, a manager goes to Settings, then Billing. Under "Available add-ons", select "Add" next to Enterprise security. The price is shown there before you add it. The "Available add-ons" list shows on the Billing page when your organization has an active subscription.
If the add-on is cancelled, the 2FA requirement is switched off and email 2FA is turned off for everyone in the organization.
Without the add-on, the Security page isn't in the Settings menu. If you open it directly, you're sent back to Settings. If you're not a manager, you never see it.
*Set it up*
In your identity provider, create an OIDC app for Ocean.io. It must return the person's email address in the ID token. Ocean.io asks for the openid, email, and profile scopes.
In Ocean.io, go to Settings, then Security, and select "Configure SSO".
Copy the Login URL and the Redirect URL from the dialog into your identity provider's app settings.
Choose your "Identity provider". This fills in the Issuer URL, and you replace the XXXXXX parts with your own values. Then enter the Client ID and Client secret from your identity provider.
Select "Save SSO settings". Ocean.io checks that it can read your provider's OpenID configuration from the Issuer URL, and doesn't save if it can't. The client secret is stored encrypted.
*Test it, then decide whether to require it*
After you save, SSO is available but optional. On the sign-in page, enter your work email and select Continue. Next to Continue you see "Sign in with SSO", and passwords still work. Test with your own account before you require it.
To make SSO the only option, switch on the SSO toggle on the Security page. Ocean.io asks "Require SSO?" and warns that password sign-in stops working for everyone. Confirm with "Require SSO". After that, people who enter their email on the sign-in page are sent straight to your identity provider. "Sign in with Google" stops working too, unless your SSO provider is Google. Anyone who tries it sees a message that says your organization requires enterprise single sign-on and points to the Sign in with SSO button.
*Who can sign in with SSO*
SSO doesn't create accounts. Each person must already have an Ocean.io user in your organization, and the email in your identity provider must match it. Managers can invite people from Settings, then User management.
*Change or remove it*
Next to the toggle, the "Configured" menu has two options:
Reconfigure SSO: enter the provider details again. This switches "Require SSO" back off, so switch it on again after you save.
Remove configuration: sign-in goes back to email and password. You need to enter your provider details again to set SSO up later.
If you don't see Security in Settings
Only managers see it. Ask a manager in your organization.
Your organization may not have the Enterprise security add-on yet. A manager can add it on the Billing page.
You can still turn on 2FA for yourself in Settings, then Account, whatever your plan.