Secure your login, manage devices and recover access

Your personal security settings protect your omotto login. They follow your account, not just the workspace you are viewing. Each team member manages their own login.

How it works

These settings are separate from workspace-wide sign-in rules and from customer verification in User identification. They do not change the password or verification settings of your WhatsApp, Google or other connected services.

You first identify yourself with your omotto password or a linked Google or GitHub account. Two-factor authentication adds a second check: a short code from an authenticator app, email or SMS text message. A backup code can replace that second check if you saved one earlier.

An authenticator app generates changing codes on your phone. It is not the omotto app. The screen calls this method Authenticator app (TOTP); TOTP means a code that changes with time.

A session is an existing sign-in on a browser or device. A trusted device is different: you have allowed that browser to skip the second-factor code for 30 days. Removing trust does not end an existing session. To remove an unfamiliar device’s current access and its ability to skip a code later, revoke both its session and its trust.

Where to find it

Open your avatar menu → My account → Security. The tabs are Password & 2FA, Sessions and Linked accounts. Passwords, verification methods and any trusted devices are on Password & 2FA.

Set it up

Set or change your omotto password

1. Open the password card on the security page.
2. If you already have an omotto password, fill in Current password.
3. Enter New password.
4. Repeat it in Confirm new password.
5. Click Change password.

If you signed up through a linked account and have not chosen an omotto password, the card says Set password instead. There is no current-password field. Fill in the two new-password fields and click Set password. Do not enter your Google or GitHub password here.

Use 10–128 characters. Common passwords and passwords containing the identifying part of your login email can be rejected. You do not have to include a prescribed mixture of uppercase letters, digits and symbols. The strength indicator is guidance; read any error shown after submitting.

Enroll an authenticator app

Before starting, install an authenticator app on your phone if you do not already have one. For example, use Google Authenticator; Google’s official installation guide includes a download link and an iPhone & iPad tab for Apple devices. Then return to omotto for these steps.

1. Click Enroll beside Authenticator app (TOTP).
2. Use your authenticator app to scan the square QR code displayed by omotto. If scanning is unavailable, use the manual setup key shown underneath.
3. Enter the app’s six-digit code in Enter the 6-digit code.
4. Click Enable.
5. Save the codes on Save these backup codes somewhere private and accessible if you lose your phone.
6. Select I have saved these codes.
7. Click Continue.

The backup-code list is shown once. Save it before leaving or refreshing that screen. Never send passwords, setup keys, QR codes or backup codes to the Coach, to a customer conversation or in an ordinary support message.

Enroll email codes

1. Click Enroll beside Email.
2. Check that the displayed email is yours.
3. Click Send code.
4. Enter the six-digit Code from the email.
5. Click Verify.

Email codes go to your omotto login email. To change that address, use your personal profile’s email-change process, not the security card. Email and SMS enrollment return to the security page after verification; they do not display the backup-code list described in the authenticator steps.

Enroll SMS codes

1. Click Enroll beside SMS.
2. Select the Country code and enter your Phone number when asked.
3. Check the destination preview.
4. Click Send code.
5. Enter the six-digit Code from the text message.
6. Click Verify.

For a new empty number, the country picker starts at Israel (+972) in both English and Hebrew. You can search by country name or calling code and choose a different country. Use a number you control and can receive text messages on. A number already used for SMS verification on another omotto account cannot be enrolled here. Verifying the number enables this sign-in method; it does not connect a WhatsApp line.

Email and SMS codes expire after five minutes. Use the latest code. For email enrollment, Resend code requests another code. Wait at least 30 seconds between requests. Repeated requests can be temporarily limited.

Current SMS setup limitation: when enrolling a phone number for the first time, Resend code does not send another code to the number you just entered. If the first text does not arrive or its code expires, contact support rather than relying on resend to finish setup. Keep any other working verification method enabled.

Link a Google or GitHub sign-in

1. Open the linked-accounts tab.
2. Click Link beside the provider you want to use.
3. Follow the provider’s sign-in and approval screen, checking which account you select.
4. Return to omotto and check that the account is listed as linked.

Only providers available in your installation offer a Link button. Linking adds a way to sign in to this omotto account. It is not the same as connecting Google Drive, a Google calendar or another business integration.

Settings

Password and two-factor controls

Setting or control	What it does	Starting value or availability
Current password	Confirms a password change. Also required to disable a verification method when you have an omotto password.	Shown only if you have set an omotto password.
New password / Confirm new password	Set the replacement password. Both entries must match.	Empty; nothing changes until you submit.
Authenticator app (TOTP)	Uses a code generated by your authenticator app.	Not enrolled until setup is completed.
Email	Sends sign-in codes to your login email.	Not enrolled until verified.
SMS	Sends sign-in codes to your verified phone.	Not enrolled until verified; availability depends on workspace policy.
Enroll	Starts setup for that method. Merely opening setup does not enroll it.	Available for methods your workspace permits.
Preferred method	Chooses the first method offered at the code step. Changes save when you select an option.	Appears after more than one method is enrolled. Initially the authenticator method; enrolling email or SMS as your first method makes that method preferred. Only enrolled, permitted methods are choices.
Disable	Removes a verification method after confirmation. Disabling the authenticator also turns off voluntary two-factor checks, even if email or SMS remains enrolled; see the warning below.	Available for enrolled methods, subject to workspace restrictions.
Backup-code count	Shows how many unused backup codes remain. It does not reveal the codes.	Appears when two-factor authentication is on. No view-again or regenerate button is provided here.

Two-factor methods start unenrolled. A workspace can require you to enroll before continuing. Voluntarily enabling two-factor authentication adds the code check to subsequent sign-ins, including linked-account sign-ins, unless the browser is trusted.

Remember me

On the email-and-password sign-in form, Remember me is unchecked by default. Selecting it lets this browser keep you signed in across browser visits. Use it only on a private device you control.

This is separate from Trust this device for 30 days. Remember me keeps a login; device trust skips the additional verification code when you sign in again. Selecting Remember me does not by itself remove the two-factor check.

Trust this device for 30 days

At the sign-in code step, Trust this device for 30 days is unchecked by default. Select it only on a private device you control, then complete verification. You still need your password or linked-account sign-in; trust skips only the additional code.

The Trusted devices card appears only when you have unexpired trusted devices. Each row shows the device, its IP address, when it was last used and how many days remain. This device identifies the browser you are using.

• Revoke removes one browser’s trust after confirmation.
• Revoke all devices appears when at least two devices are listed. Confirm with Revoke all to include this browser too.
• Trust expires after 30 days; using it does not restart that period.
• Clearing this browser’s cookies removes its ability to present the saved trust.

Sessions

Column or control	Meaning
Device	A recognizable description of the browser or device signed in.
IP	The network address recorded for that session, not a precise physical location.
Last seen	The last recorded activity time for that session.
Current	The session you are using now.
Revoke	Ends another session’s access when that browser next contacts omotto. It does not remove trusted-device status.

There is no Revoke button on the current session’s row. Use Sign out in your avatar menu to leave your current session.

Linked accounts

Google and GitHub can be separate sign-in methods. A linked card can show the email recorded when it was linked. When you sign in with a provider for the first time, omotto can also link it automatically if the provider supplies a verified email matching an existing omotto account. If there is no matching account, provider sign-in does not create one through this flow.

Unlink removes that provider’s link to omotto; it does not delete the provider account.

omotto refuses to unlink the last linked account if you have no omotto password. Set a password or link another account first. Also check that the sign-in method you keep is permitted by the workspace you need to access; keeping a method does not override workspace rules.

What happens when…

…your workspace requires two-factor authentication?

You may be taken to a setup screen before you can continue. Authenticator and email codes are always permitted methods; the workspace can disable SMS. A method marked Disabled by organization policy cannot be enrolled from the card.

You cannot remove the last permitted enrolled method while an active workspace membership requires two-factor authentication. The authenticator method has a stricter restriction: its removal is refused while any active workspace requires two-factor authentication, even if another method is enrolled. Contact the workspace owner if the displayed controls do not let you make a needed change. A pending invitation alone does not prevent removal; accepting it can require setup again.

These are personal enrollment controls, not a way to change the workspace’s allowed sign-in methods. If your preferred method is no longer permitted, omotto uses another permitted enrolled method or asks you to set one up.

…you lose your phone or cannot receive a code?

1. At the code step, choose Use a different method, if shown, and select another enrolled method.
2. If you saved a backup code, choose Use a backup code instead and enter one unused code.
3. After regaining access, review your methods, sessions and trusted devices.

Each backup code works once. It replaces the verification code, not the initial password or linked-account sign-in. The remaining-code count is not a way to recover codes you did not save. If you have neither another working method nor a saved backup code, contact support; do not assume support can bypass ownership checks.

…you forget your omotto password?

1. On the sign-in screen, click Forgot password?
2. Enter your omotto login email.
3. Click Send reset link.
4. Open the link from the email within six hours.
5. Enter New password and Confirm password.
6. Click Save password.

For privacy, the confirmation does not reveal whether an account exists for the address. A reset does not remove two-factor authentication. You may need to sign in again and complete the code check.

If the link opens while you are already signed in, the You’re still signed in screen offers Sign out and continue. This signs out the current browser session so you can use the reset link. Alternatively, keep your current session and return to the homepage.

…you change or reset your password?

All of your trusted-device approvals are removed, so those browsers need a code at their next applicable sign-in. Changing your password from the security card keeps your current normal session usable. Review other sessions separately rather than treating a password change as a substitute for the sessions list. Password changes and resets also revoke your connected-agent authorizations across your workspaces; reconnect those agents if you still want them to have access.

…you disable a verification method?

If you have an omotto password, enter it in the confirmation dialog. If you have never set one, the signed-in session confirms the action; the dialog does not ask for a Google or GitHub password. omotto emails a confirmation.

Disabling SMS also clears the verified phone number used for SMS codes. Removing the last method removes its backup codes. Disabling the authenticator method also removes the existing backup codes, so do not rely on an old saved list afterward.

Important current limitation: if no workspace requires two-factor authentication, disabling the authenticator also turns off the account’s voluntary two-factor checks. Email and SMS can still appear enrolled, but subsequent sign-ins no longer ask for their codes. Do not disable the authenticator expecting an enrolled email or SMS method to keep protecting sign-in. Contact support before making that change if you want to keep two-factor protection.

Troubleshooting

• A code is invalid or expired: use the latest email or SMS code, or the current authenticator code for the correct account. For authenticator codes, check your phone’s date and time settings. Repeated wrong attempts can temporarily lock code verification; wait for the time stated on screen.
• No email arrives: check the login address and spam folder, then use the resend option after waiting. A password-reset confirmation alone does not prove the address has an account. Contact support if delivery still fails.
• No SMS arrives during first-time enrollment, or its code expires: the enrollment resend control currently cannot send another code to your pending number. Contact support and keep any other working method enabled.
• SMS enrollment rejects your phone: check the selected country and number. The same number cannot provide SMS verification for two omotto accounts at once. If it belongs to an old account you cannot access, contact support.
• Adding an authenticator returns straight to Security: this can happen when you already use email or SMS verification. Contact support rather than turning off your only working method to try again.
• A backup-code count appears but you never saved a list: the count does not expose those codes. Email/SMS enrollment does not show a backup-code saving step. Keep a working enrolled method and contact support if you need help planning recovery.
• Google or GitHub says no account is linked: check that you chose the provider account whose verified email matches your omotto login. Alternatively, sign in to your existing omotto account with an available method, then link the provider from within that account.
• The provider account is already linked elsewhere: check which Google or GitHub account you chose. Contact support if you cannot resolve the account mismatch; do not create duplicate workspaces to work around it.
• You see an unfamiliar device: revoke its session and trusted-device entry. Change your password if it may be known to someone else. If access remains suspicious or you cannot get back in, contact support. Never send your password, verification codes or backup codes as evidence.

Related

• Your personal profile and workspaces
• Workspace settings
• Team members and groups
• Permissions and access
• User identification and customer verification