How Signing In and Account Security Work

This guide explains how it all fits together. For one job at a time, the short articles in this topic have the exact steps.

Two-Step Verification

Set up an authenticator app so Agoo asks for a six-digit code each time you sign in, step by step for first-timers.

Two-step verification means signing in takes two things: your password (or an email code) and a six-digit code from an app on your phone. Someone who steals or guesses your password still can't get in without your phone.

Owners and Admins must use it. So does everyone in an organisation that turns it on (Settings → Security). Everyone else can turn it on, and we recommend it.

What You Need

A phone and a free authenticator app. If you've never used one, pick one of these:

Both are free and work without a network connection once set up. If you already use 1Password, Bitwarden or your iPhone's Passwords app, those can hold the code too.

Set It Up

You'll be asked the first time you sign in if your role needs it. Otherwise open Account → Sign-in and security → Two-step verification.

1. 1

   Show your QR code

   Give this phone a name if you like (such as "My phone"), then choose I have the app: show my QR code. Agoo shows a QR code and, under it, the same thing as a setup key.

2. 2

   Add Agoo to the app

   Google Authenticator

   Open Google Authenticator, tap +, then Scan a QR code, and point your camera at the code on your screen.

   Microsoft Authenticator

   Open Microsoft Authenticator, tap +, choose Other account (Google, Facebook, etc.), and point your camera at the code on your screen.

   "Agoo" appears in the app with a six-digit code that changes every 30 seconds.

3. 3

   Type the code into Agoo

   Type the six-digit code the app shows into Agoo and choose Verify and continue. That's it: from now on Agoo asks for the current code each time you sign in.

Setting up on the same phone you're signing in on

You can't scan a code on your own screen. Tap Setting up on this phone? Add to my authenticator app instead: your phone opens the authenticator app with Agoo ready to add. If nothing opens, use the setup key below.

Signing in to the Agoo Workspace app for the first time works the same way: the app sets up your authenticator with you on the phone.

If the QR code won't scan

In the app, choose Enter a setup key (Google Authenticator) or Enter code manually (Microsoft Authenticator). Type any account name, such as "Agoo", then the setup key Agoo shows (tap the key in Agoo to copy it). Leave the type as time-based.

If a Code Doesn't Work

• Use the newest code. Each code lasts 30 seconds. If it's about to change, wait for the next one.
• Check your phone's clock. Codes depend on the time. Set your phone's date and time to automatic (Settings → General → Date & Time on iPhone; Settings → System → Date & time on Android).
• Pick the right account. If the app holds several codes, use the one named Agoo.

Keep a Spare

Add a second authenticator, on another phone or in a password manager, from Account → Sign-in and security → Add another authenticator. If you lose one phone, the other still works.

Use a Passkey Instead

A passkey counts as two-step verification by itself: sign in with one and Agoo asks for no code. If Agoo asks for your code after your password, choose Use a passkey to unlock with your face, fingerprint, screen lock or security key instead.

Backup Codes

Backup codes stand in for your authenticator when your phone isn't to hand. Make them in Account → Sign-in and security, under Two-step verification → Backup codes: confirm with a code from your authenticator, and Agoo shows you ten codes, once. Save them somewhere safe away from your phone, such as a password manager or a printed page. Agoo keeps only a scrambled form of them, so it can't show them again.

• Each code works once. When Agoo asks for your six-digit code, in the Console or in Agoo Workspace, choose Use a backup code.
• Using one takes your authenticators off, because your phone may be in someone else's hands, and ends your other sign-ins. You set up your authenticator again straight away.
• Making a new set stops every old code working. Agoo tells you when you're running low.
• Agoo emails you whenever codes are made or one is used, so you'd know if it wasn't you.

Lost Your Phone?

Use a backup code if you have one. If you've lost every authenticator and have no backup codes, choose Lost your phone? when Agoo asks for your code. We email a link to your sign-in address, then an Owner or Admin of your organisation checks it's really you and approves (or Agoo does, after its own identity check, and the reset waits 24 hours). Then you set up your new phone. The full steps are in Account recovery.

Passkeys

Sign in to the Console and Agoo Workspace with your face, fingerprint, screen lock or a security key, with no password to type and no code after.

A passkey lets you sign in with the same thing you use to unlock your phone or computer: your face, your fingerprint, your screen lock, or a small security key you plug in or hold to your phone. There's no password to type and no six-digit code after, because a passkey already counts as two steps: something you have (the device) and something you are or know (your face, finger or PIN).

Passkeys can't be phished. A passkey only answers to Agoo's real address, so a fake page that copies Agoo's look gets nothing from it, even if you're fooled into opening it.

What Works Where

One passkey signs you in to everything you use at work:

A passkey made on your iPhone is kept in your Passwords app (iCloud Keychain) and reaches your other Apple devices; on Android it's kept in Google Password Manager and reaches your other Android devices and Chrome. A password manager such as 1Password or Bitwarden can hold them too. Agoo Reviews and Agoo Forms have passkeys of their own, kept separately.

Add a Passkey

1. 1

   Open Passkeys

   In the Console, go to Account → Sign-in and security → Passkeys and choose Add a passkey. In Agoo Workspace, it's Account → Security → Passkeys.

2. 2

   Confirm it's you

   Enter the six-digit code from your authenticator app. If you don't use one, Agoo emails you a code instead. If you already have a passkey, you can confirm with that.

3. 3

   Make the passkey

   Your device asks for your face, fingerprint or screen lock, and saves the passkey. To use a security key instead, choose the security key option and plug it in or hold it to your phone.

You'll get an email whenever a passkey is added to or removed from your account, so you'd know if it wasn't you. Add a second one (another device, or a security key) as a spare. You can keep up to ten.

Sign In with a Passkey

Choose Sign in with a passkey on the Console's sign-in page or in Agoo Workspace, then unlock as your device asks. You're in, with no code after. If Agoo asks for your authenticator's code after a password, you can choose Use a passkey there instead.

Remove a Passkey

Open Passkeys, choose Remove beside it, and confirm it's you the same way as when adding one. The passkey stops signing you in to Agoo straight away. It stays in your phone's password manager until you delete it there too.

Your Organisation's Rules Still Apply

A passkey proves it's you; your organisation still decides what you can open. Organisations that ask everyone to use Google or Microsoft, or ask for two-step verification, accept a passkey as two-step verification.

Agoo's Own Staff

People who work for Agoo are moving to security keys for Agoo's own administration, so that a stolen password and authenticator code alone can't open it. Agoo staff only ever look at your organisation's records through support access, which you see and can end.

Single Sign-On

Let staff sign in with their Google or Microsoft work account.

Single sign-on (SSO) lets your staff sign in to the Console and the Agoo Workspace app with the work account they already have: Continue with Google or Continue with Microsoft on every plan, Free included.

Google and Microsoft sign-in comes at no extra price, on every plan. Whatever you require, the Owner always keeps a password and an authenticator, so nobody can lock your organisation out. You can also start your organisation with Google or Microsoft.

Sign in with Google and Microsoft is in the Console and Agoo Workspace on iPhone, iPad and Android.

Sign In with Google or Microsoft (Every Plan)

On the sign-in page, people choose Continue with Google or Continue with Microsoft, sign in with their work account there, and come back signed in to Agoo. In the Agoo Workspace app the same buttons open Google's or Microsoft's own page in a secure browser sheet, so an account already signed in on the phone is offered straight away, and the app opens signed in. If your account uses two-step verification (Owners and Admins always do), Agoo still asks for the authenticator's code next: Agoo can't see whether Google or Microsoft asked for a second step, so it never assumes they did.

On the sign-in page it's sign-in only: nobody gets an Agoo account just by signing in. People are invited first. The first time someone chooses Google or Microsoft, Agoo links that account to their Agoo account only when Google or Microsoft confirms the email address is theirs and it's the same as their Agoo account's. Otherwise they sign in with their password or an email code, and add it themselves.

If Google or Microsoft confirms an email that has no Agoo account, the sign-in page says so and offers two ways on: start an organisation with that account from the sign-up page (see Sign up with Google or Microsoft), or, to join a team that already uses Agoo, ask its Owner or an Admin to invite you.

Add Google or Microsoft to your own account

1. 1

   Open Your account → Sign-in and security → Sign-in methods

   You see your password, your email code (always there) and any Google or Microsoft accounts you sign in with. In the app, it's Account → Sign-in methods.

2. 2

   Choose Add Google or Add Microsoft

   Confirm it's you first, with your authenticator's code, or if you don't use one, a code Agoo emails you. Then choose your account. It can have a different email from your Agoo account, unless your organisation only allows its own accounts.

You can remove one the same way. You can't remove the one you're signed in with now: sign in another way first. Agoo emails you whenever a way to sign in is added or removed, so you'd know if it wasn't you. An email code always works, so you can't lock yourself out by removing your password.

Accept an invitation with Google or Microsoft

When your organisation allows it, the invitation page offers Accept with Google and Accept with Microsoft beside setting a password. The account you choose must have the email address you were invited at. An Owner's invitation always asks for a password.

Your organisation's rules

Owners and Admins set them in Console → Settings → Security → Sign in with Google and Microsoft:

Someone in several organisations is affected only where the rules apply: if Volta Bank doesn't allow Google sign-in, signing in with Google still opens their other organisations, and the Console and the app tell them how to open Volta Bank, with a Continue with Microsoft button when that's what it asks for.

1. 1

   Choose who can sign in this way

   Switch providers on or off, and add your domains or organisations if you want only work accounts. Save. Sign-ins that no longer meet the rules lose access at once.

2. 2

   Sign in with Google or Microsoft yourself

   To require it, you must be signed in with an account the rules allow, so you can't lock yourself out.

3. 3

   Require it

   Turn on Require Google or Microsoft sign-in, check how many members haven't signed in this way yet, and confirm with your authenticator's code. Every member is emailed.

Every plan includes these rules, Free too, so changing plan never changes how your people sign in. Agoo can't see when an employer suspends someone's Google or Microsoft account, so if you require it, consider shorter sign-ins, and remove leavers in People: that ends their access at once.

What Agoo receives

Only the account's name, its email address, Google's or Microsoft's confirmation that the email is the person's, and which Google Workspace domain or Microsoft organisation it belongs to. Never mail, contacts, files or calendars, and Agoo keeps no access to the account after sign-in. Calendars are separate: each person chooses to connect theirs. If your IT team approves apps before staff can use them, they approve Agoo once: see Google or Microsoft.

To stop signing in with Google or Microsoft, remove it in Sign-in methods (above). To remove Agoo from the Google or Microsoft account as well, use myaccount.google.com/connections, myaccount.microsoft.com (work or school) or account.live.com/consent/Manage (Outlook.com).

If it doesn't work

When Google or Microsoft doesn't open Agoo, the sign-in page says why. Your password or an email code always works meanwhile.

Account Recovery

What happens when someone loses the phone with their authenticator app, how Owners and Admins approve a reset safely, and how an organisation gets a new Owner when its Owner has gone.

Two-step verification keeps your organisation safe because a password alone isn't enough. That also means losing your phone can lock you out. Agoo's account recovery gets the right person back in without making it easy for anyone else: it checks your email, then asks someone who knows you, and it always tells you what's happening.

Lost Your Authenticator?

If the phone with your authenticator app is lost, broken or reset, use a backup code if you saved them: choose Use a backup code when Agoo asks for your six-digit code, then set up your new phone. If you don't have a spare authenticator or a backup code:

1. 1

   Ask from the sign-in page

   Sign in with your password or an email code as usual. When Agoo asks for your six-digit code, choose Lost your phone?, then Email me a link.

2. 2

   Confirm it's you

   Open the link we email to your sign-in address (on any device), and choose Yes, it's me. The link works once, for an hour. If you didn't ask for it, ignore the email: nothing changes, but someone knows your password, so change it.

3. 3

   Someone who knows you approves

   An Owner or Admin of your organisation, at least as senior as you, is asked to approve. They'll check it's really you: in person, on a video call where they can see you, or by calling a number they already have for you. As soon as they approve, you can finish.

   If nobody can approve (you're the Owner, or your organisation leaves resets to Agoo), Agoo checks your identity itself, by video call against a passport or another photo ID, or by calling a number already on record. Agoo never checks a Ghana Card by looking at it, on a call or in person, as L.I. 2523 requires. After that, the reset waits 24 hours for your safety.

4. 4

   Finish and add your new phone

   Back on the sign-in page, choose Finish the reset. Every authenticator on your account is removed, you're signed out everywhere else, and you set up your new phone straight away.

You're emailed at each step. The approval email has a stop link: if you didn't ask for any of this, use it, change your password and call us on +233 30 398 3393. Found your phone in the meantime? Choose I've found my phone: withdraw this, or withdraw it from Account → Sign-in and security.

You can ask three times in 30 days. After that, write to support@agoohq.com from your sign-in address.

Approving a Colleague's Reset (Owners and Admins)

When someone in your organisation asks for a reset, every Owner and Admin who may approve it is emailed and sees it at the top of the Console and in the bell.

1. Check it's really them. In person, on a video call where you can see them, or by calling a number you already had for them. Never approve because of an email or a message alone, however urgent it sounds: whoever asked knows their password.
2. Open Settings → Security → Lost authenticators and account recovery and choose Approve. Say how you checked. Or Decline, with a reason they'll read.

You can approve a reset for anyone who is no more senior than you in your organisation: an Admin can't approve an Owner's reset, for example. If they belong to several organisations, the most senior role they hold anywhere counts. Resets of Agoo's own staff are never approved by an organisation.

Leave resets to Agoo

If your organisation would rather no colleague can approve resets, turn off Owners and Admins can approve a colleague's reset in Settings → Security. Agoo then checks the person's identity itself, and every reset waits 24 hours.

When the Owner Has Gone: Owner Handover

Each organisation has one Owner, and only the Owner can transfer ownership. If the Owner has left, died, can't be reached or has lost access to their sign-in email, contact Agoo. We'll ask for evidence (for example, a letter on your organisation's letterhead signed by its directors) and check the request through a phone number or email address we already hold.

Then Agoo's platform owner starts an Owner handover:

• It waits 72 hours. The current Owner and every Admin are emailed straight away, with a link to stop it, and see it at the top of the Console. Any of them can stop it there or in Settings → Security.
• Then it completes. The member you chose becomes the Owner, or someone new is invited by email as the Owner. The previous Owner becomes an Admin or loses their sign-in, as agreed. Everyone is emailed again.
• It's all recorded in your audit trail, under Agoo support, with the reason.

Agoo never makes someone the Owner any other way, and never in a hurry. Emergency access can fix urgent problems in the meantime, but it never hands anyone control.

See Every Recovery

Owners and Admins see two-step resets of their people (the last 30 days) and Owner handovers (the last 180 days) in Settings → Security. Every step is in your audit trail, under Account recovery.

Sign-Ins and Sessions

How long Agoo keeps you signed in, where you're signed in, the alert for a new device, and how Owners and Admins sign someone out everywhere or make sign-ins shorter.

Agoo keeps you signed in on the browsers and phones you use, so you aren't typing your password and authenticator code all day, and it shows you every one of them, so nothing stays signed in that you don't know about.

How Long You Stay Signed In

When a sign-in ends, Agoo asks for your password again, and for your authenticator code if you use two-step verification. Your organisation can make both lengths shorter (below); if you belong to more than one organisation, the shortest applies.

Where You're Signed In

Account → Sign-in and security → Where you're signed in (in the Console), or Account → Where you're signed in (in the app), lists every browser and phone signed in to your account:

• What it is: Chrome on Windows, Safari on iPad, an iPhone with the Agoo Workspace app.
• How it signed in: a password, an email code, or Google or Microsoft, in the Console and in the app.
• Roughly where: the town and country its internet address points to. It's approximate, and a mobile network or a VPN can put it somewhere else.
• When it was last used, and whether it passed two-step verification.

The list updates live: sign in on another device, or sign one out, and it changes on the page within seconds, with no need to refresh. Sign out any of them, and it stops working at once. Sign out everywhere else ends all but the one you're using. Below them, Earlier sign-ins shows the last 90 days', with how each ended (signed out, ended by you, ended by your organisation, unused for a while, or reached its time limit).

New Sign-In Alerts

When your account is signed in to on a device it hasn't been used on in the last 90 days, Agoo emails you straight away, and sends a notification to your phone if you have the Agoo Workspace app. They say what the device is, which part of Agoo, how it signed in (with Google or Microsoft, say), and roughly where. If it was you, there's nothing to do.

If it wasn't you:

1. Open Where you're signed in and Sign out that device.
2. Change your password (Account → Sign-in and security → Password).
3. Turn on two-step verification if you haven't: it stops anyone who only has your password.

Agoo also emails you when your password, your sign-in email or your authenticators change, and when Google or Microsoft sign-in is added to or removed from your account. These emails can't be turned off: they keep your account safe.

For Owners and Admins

Sign someone out everywhere

For a lost or stolen phone, a shared password, or someone leaving: open them in People, then Where they're signed in shows their browsers and phones. Sign out everywhere ends every one at once, with an optional reason for the audit trail. They can sign in again with their password unless you also remove their sign-in. Admins can't sign out the Owner. The Owner ends their own sign-ins from Account → Sign-in and security.

Make sign-ins shorter

Settings → Security → How long sign-ins last sets, for everyone in your organisation:

• The Console, with Keep me signed in: 30 days (Agoo's), 14, 7 or 1.
• Agoo Workspace: password again every: 30 days (Agoo's), 14, 7 or 1.

You can only make them shorter. Sign-ins already past a new length end within the hour. Both are on every plan, and changes are in the audit trail.