Account security

This page is about protecting sign-in to your Notifly account and about what happens to sessions when the password changes. Keys for programs are described separately — on the API tokens page.

Registration and email confirmation

To register you need an email and a password. You can sign up in the web admin or from the login screen of the Android app.
Password — at least 8 characters and no longer than 72 bytes (a bcrypt limit: about 36 Cyrillic characters). There are no composition rules — pick a long passphrase.
After registration a confirmation link is emailed to you; it is valid for 24 hours. You cannot sign in until the address is confirmed. Registering again with the same unconfirmed address simply re-sends the link.

Every sign-in creates a device — a browser or app session with its own token (C…). All devices of the account are listed in the admin under Devices: name, platform, time and IP of the last connection.

Signing in again from the same browser does not create new devices; it refreshes the token of the existing one.
Signing in from a new device sends a “new sign-in” email — with the device, IP and time and links to password recovery and the device list.
Signing out immediately invalidates the device token and stops real-time delivery to it. The Android app deletes its device entirely when you sign out.
Password guessing is limited: no more than 20 sign-in attempts per 5 minutes from one IP and no more than 10 wrong passwords per account per 15 minutes — after that the server responds 429.

Devices and the plan limit

The number of active devices is limited by the plan (Free — 3, Pro — 15, Business — unlimited; see Quotas and plans). If the limit is reached, signing in from a new device suspends the oldest active device.

Under Devices you can:

delete a device — its token stops working and the app on it is signed out (you can delete the current one too — then you are signed out right away);
Delete all — delete all devices except the current one;
suspend a device to free a slot in the limit. This is not a lock: the next request from that device makes it active again. To close access, delete the device;
configure channel notifications — mute individual channels on a specific device without losing access to them.

Two-factor authentication (2FA)

2FA is turned on in your Profile — the Two-factor authentication card. It has three rows: the authenticator app, “Notifly mobile” and recovery codes.

Authenticator app (TOTP)

Click Enable 2FA and scan the QR code in any authenticator app (Google Authenticator, 1Password, Aegis, etc.) — or enter the secret manually.
Enter the first six-digit code — 2FA is turned on.
Save the recovery codes shown right after enabling.

The codes are standard TOTP (RFC 6238): 6 digits, a 30-second step. The same code is not accepted twice.

Recovery codes

You get 10 codes of the form XXXX-XXXX-XXXX-XXXX; they are shown once — save them in a password manager.
Each code is single-use. You can sign in with one instead of an app code if your phone is lost. Using a code sends an email with the number of codes left.
When 3 or fewer codes remain, the counter in the profile is highlighted. New recovery codes issues a new set — the old ones stop working at once.

An additional method on top of TOTP: instead of typing a code, you approve the sign-in in the Notifly mobile app (Android or iOS) where you are already signed in.

Activation. In the 2FA card click Enable next to “Notifly mobile” — the admin shows a two-digit code. Open the app on your phone (menu → Confirm sign-in) and enter that code. You can connect several phones (Add device); an email is sent for each one.
Sign-in. The login screen shows a large two-digit code, and the phone gets a “Confirm sign-in” notification. Enter the code from the login screen on the phone — and the sign-in completes. The code is typed on the phone rather than an “Allow” button being tapped, so you cannot approve someone else’s sign-in by accident. If it was not you — just close the screen on the phone.
Three wrong codes on the phone cancel that sign-in attempt.
A deleted or suspended device automatically stops approving sign-ins. A single phone is removed with the cross in the 2FA card, the whole method — with the Deactivate button.

After a correct password a second step appears: a code from the authenticator, approval from the phone (if connected, it is offered first) or a recovery code. The second step has 5 minutes; after 5 wrong codes the attempt is voided, and after 10 failed attempts in 15 minutes the server temporarily responds “Too many attempts”. The owner gets an email about every wrong code: since the password matched, someone else knows it — change it.

The Android app asks for an authenticator code or a recovery code when signing in.

If both the phone and the codes are lost

An administrator of the service can reset 2FA — email support@notifly.ru. The account owner always gets an email about a 2FA reset.

Turning 2FA off

Disable in the 2FA card removes the secret, the recovery codes and the connected phones; sign-in is protected by the password alone again. An email is sent about it.

Confirmation for sensitive actions

Even in an open session some actions require confirming once more that it is you: changing the password, any 2FA change (enabling, disabling, new codes, connecting and removing phones), and for administrators — managing users and plans.

Without 2FA you are asked for the password, with 2FA — for an authenticator code or a recovery code.
The confirmation lasts 15 minutes on this device — you will not be asked again during that time.
All such windows are closed when the password is changed or reset and when 2FA is enabled or disabled.

API tokens cannot get this confirmation, so they cannot be used to change the password, configure 2FA or manage users.

Changing the password

Profile → Change password: the current password and the new one.

The current device stays signed in, while all other devices are signed out — they need to sign in again; real-time delivery to them stops at once.
API tokens and channel tokens keep working.
An email about the password change is sent, with a recovery link — in case it was not you.

Resetting the password

If you forgot the password — Forgot password? on the login screen (the Password recovery page). The link from the email is valid for 24 hours and works once.

A reset is designed for recovering after an account takeover, so it is stricter than an ordinary password change:

all devices are signed out, including the one the reset is done from;
all API tokens are deleted — issue new ones;
channel tokens are kept so that integrations do not break;
2FA stays on: the next sign-in still asks for the second factor.