Trellis

Two-step sign-in

Set up a code from an authenticator app as a second step when you sign in, keep your recovery codes, and get back in if you lose your phone.

Two-step sign-in (multi-factor authentication) asks for a second thing when you sign in: a 6-digit code from an authenticator app on your phone. Someone who gets into your email, or learns your password, still can't get into Trellis without your phone.

It belongs to your account, not to one church. If you're in more than one church, it covers all of them.

Who has to use it

It's required for anyone who is an Admin or in Finance at any church. Everyone else can turn it on if they want it.

If it's required for you, you have 14 days to set it up. The 14 days count from when Trellis starts requiring it, or from when you're made an admin or put in finance, whichever is later. Until then, a notice at the top of every page gives your date, with Set up now (Set up on a phone). After that date, Trellis won't open anything else until you've set it up.

If you stop being an admin or in finance at every church, it's no longer required. If you'd already set it up, it stays on.

Set it up

You need an authenticator app, such as Google Authenticator, Microsoft Authenticator, 1Password or Authy. Install one on your phone first.

  1. Open your menu and press Your profile.
  2. Press the link next to Two-step sign-in. It says whether it's on, and opens the Two-step sign-in page.
  3. Press Set up.
  4. Scan the QR code with your authenticator app. If you can't scan it, type the key under it into the app instead.
  5. Type the 6-digit code the app shows under Code, then press Turn on.
  6. Save your recovery codes (see below), tick I've saved these, and press Done (or Continue, if Trellis sent you here on your way somewhere).

Turning it on signs you out on your other devices. Sign in again there, with a code from your app.

Sign in with it on

You sign in the same way as before, with an email link, an email code or a password. Then Trellis asks for the code from your authenticator app.

  1. Open your authenticator app and find Trellis.
  2. Type the 6-digit code under Code.
  3. Press Continue.

Codes change every 30 seconds. If Trellis says "That code didn't match", try the newest one.

After 5 wrong codes, Trellis stops taking codes for up to 5 minutes. Wait, then try again.

Recovery codes

When you set up, Trellis gives you 10 recovery codes, like 7KQ4M-2XWPD. Each one works once, if you lose your phone. Keep them somewhere apart from your phone. Press Copy or Download (.txt) to keep them. They're only shown once.

The Two-step sign-in page says how many you have left, and warns you when you're down to 3 or fewer.

To get a fresh set, press New recovery codes, then Make new codes. The new codes replace all ten, and the old ones stop working.

If you lose your phone

With a recovery code

  1. Sign in as usual.
  2. When Trellis asks for the code from your app, press Use a recovery code instead.
  3. Type one of your recovery codes and press Use this code.

Using a recovery code removes your authenticator app from your account and signs you out on every other device. Trellis then takes you to the Two-step sign-in page to set it up again on your new phone. If it's required for you, nothing else opens until you do: there are no 14 days this time.

With no recovery codes

Write to support@trellischurch.app from the email you sign in with. Support checks it's you, then removes the authenticator app from your account. For an admin, that check includes another admin at your church or your church's phone number. You'll get an email when it's done, and can then set up again.

Turn it off

If two-step sign-in isn't required for you, you can turn it off.

  1. Open the Two-step sign-in page from Your profile.
  2. Press Turn off.
  3. Type a code from your authenticator app, then press Turn off.

If you're an admin or in finance, there's no Turn off. It stays on while the role does.

The emails Trellis sends

Trellis emails you when:

  • two-step sign-in is turned on;
  • it's turned off;
  • a recovery code is used to sign in.

If someone keeps trying wrong codes, or keeps starting to sign in without finishing, Trellis signs you out everywhere and emails you.

Still stuck? Ask Silas

Read next