Sign-in email, password and two-factor sign-in

The Security page holds how you sign in to Scanfully: the email address you sign in with, your password, and two-factor sign-in with an authenticator app. To open it, click your name at the bottom of the menu, choose Account, then Security in the account menu.

Your sign-in email, password and two-factor sign-in can only be changed here, in the dashboard. An API token or an AI app connected through MCP can see your email address and whether two-factor sign-in is on, but can never change them or your password.

Change your sign-in email

The Sign-in email panel shows the email address you sign in with. It is also your account email: notifications set to your account email go there, and so does billing email when you have no billing address set.

1. Click Change.
2. Enter the New email address and your Current password.
3. Click Send links.
4. If Confirm it is you appears, enter a code from your authenticator app (see Confirm it is you).

Scanfully then emails a link to your current address and another to your new address (“Confirm the new sign-in email of your Scanfully account”). Open both, in either order. After the first, the page says One address confirmed; after the second, it says Sign-in email changed, and from then on you sign in with the new address. The links work for an hour.

Asking for both links means that someone who gets into your dashboard, on a computer you left unlocked or even with your password, cannot move your account to an address of their own: they would need your current mailbox too.

Until both links are opened nothing changes, and you still sign in with your current address. The panel shows Changing to the new address, with One address confirmed once you opened one of the links. Send again sends new links; the earlier ones then stop working. If you change your mind, leave the links unopened: they expire after an hour.

When the change is done, Scanfully emails your old address about it (see Security emails). Notifications set to your account email, and billing email without a billing address, go to the new address. Addresses typed into a notification stay as they are: change those on the notification itself. If you also sign in with Google, GitHub or X, that keeps working.

If the change cannot go ahead, the dialog says why, for example That is already your sign-in email., Another Scanfully account uses this address., That is not your current password., or We just sent links. Wait a minute before asking again.

If you can no longer open your current mailbox, you cannot open its link. Contact support to change the address.

If your account has no password

Changing your sign-in email needs your password. An account that signs in with Google, GitHub or X only adds a password first: the panel then says Add a password first to change your sign-in email. See If you sign in with Google, GitHub or X.

An account without any email address cannot change it here, and the panel says Your account has no email address. Contact support to add one.

Change your password

1. Enter your Current password.
2. Enter a New password: at least 8 characters, with at least one letter and one digit.
3. Enter it again in Repeat the new password.
4. Click Change password.

The page then says Password changed. Your other devices were signed out. You stay signed in on this device; on your other devices, sign in again with the new password. Scanfully also sends you an email about the change.

With two-factor sign-in on, Scanfully may ask for a code from your authenticator app first (see Confirm it is you).

If the current password is not right, the page says That is not your current password. After too many wrong passwords it says Too many wrong passwords: wait 15 minutes, then try again.

If you sign in with Google, GitHub or X

An account that signs in with Google, GitHub or X has no Scanfully password, so the Password panel says which one you sign in with instead of showing the form. Two-factor sign-in works with these sign-ins too.

To add a Scanfully password, click Add a password. Scanfully emails a link to your sign-in email; open it and choose a password on Set a new password. Afterwards you can sign in either way, with Google, GitHub or X, or with your email address and the password, and you can change your sign-in email. Forgot your password? on the sign-in page sends the same link.

If you forgot your password

Click Forgot your password? on the sign-in page, enter your email address and click Send reset link. The link in the email opens Set a new password.

With two-factor sign-in on, the link first asks for a code from your authenticator app, so a reset link alone cannot open your account. As with a change on the Security page, your other devices are signed out and you get an email.

Two-factor sign-in

With two-factor sign-in on, Scanfully asks for a 6-digit code from an authenticator app every time you sign in, after your password or your Google, GitHub or X sign-in. Someone who knows your password cannot sign in without that code.

The Two-factor sign-in panel shows On or Off, and lists your authenticators. Each shows its name, the type Authenticator app, the date it was added, and when it was last used (or Not used yet).

Turn it on

You need an authenticator app: any app that makes 6-digit sign-in codes, on your phone (such as Google Authenticator or Microsoft Authenticator) or in your password manager (such as 1Password or Bitwarden).

1. Click Add an authenticator app.
2. Give it a Name, such as the phone or password manager it is on (iPhone, 1Password), and click Next. Each authenticator needs its own name.
3. In your authenticator app, add an account and scan the QR code. If you cannot scan it, click Copy key under Cannot scan it? Enter this key and paste the key into the app. On the phone that has the app, you can also tap On this phone? Open it in your authenticator app. The app lists the account as Scanfully.
4. Enter the code the app shows in 6-digit code from the app, and click Turn on two-factor sign-in. The code is also checked as soon as you type the sixth digit.

The page then says Two-factor sign-in is on, and Scanfully sends you an email. From now on, signing in asks for a code.

Cancel closes the dialog without adding the authenticator. The QR code and the key are only shown while you add the authenticator. Keep the key to yourself: anyone who has it can make your codes.

Add a second authenticator

Scanfully has no backup codes. If your only authenticator is on a phone you lose, you cannot sign in until support resets two-factor sign-in for you (see If you lose your authenticator). With one authenticator, the panel shows Add a second authenticator as a reminder.

Add the second one the same way, with Add an authenticator app, on another phone or in your password manager, and finish with Add authenticator. Codes from any of your authenticators work for signing in.

Sign in with two-factor

After your password, or after Continue with Google, GitHub or X, Scanfully shows Enter your sign-in code.

1. Open your authenticator app and find the code for Scanfully.
2. If you have more than one authenticator, choose the one you use under Authenticator.
3. Enter the code in 6-digit code and click Continue.

If you were on your way to something, such as approving a WordPress site connection or an AI app, you carry on there after the code.

If the code is not accepted, the page says That code did not work. Enter the newest code from your app. The codes change every 30 seconds, so use the one the app shows now. After too many tries it says Too many attempts: wait a few minutes, then try again. Sign out on this screen takes you back to the sign-in page.

Confirm it is you

Removing an authenticator, and changing your sign-in email or password while two-factor sign-in is on, need a code from the last 10 minutes. If your last code is older, Scanfully shows Confirm it is you first. Enter a code from any of your authenticators and click Confirm, and the change goes ahead.

Remove an authenticator

1. Click Remove next to the authenticator.
2. Confirm with Remove authenticator.
3. If Confirm it is you appears, enter a code.

Codes from that authenticator stop working, and you get an email. If it was your only one, two-factor sign-in turns off: signing in then needs only your password or your Google, GitHub or X sign-in.

To move to a new phone, add the new one first, then remove the old one.

If you lose your authenticator

If you have a second authenticator, sign in with a code from it. Then remove the lost one on the Security page and add your new phone.

If you have no other authenticator, email support@scanfully.com. The sign-in code screen shows this address too, under No access to your authenticator? Support first checks that the request comes from the owner of the account, then resets two-factor sign-in: every authenticator is removed and two-factor sign-in is off. You get an email when that is done.

You can then sign in with your password or your Google, GitHub or X sign-in alone. Add a new authenticator on the Security page to turn two-factor sign-in on again.

API tokens, connected apps and WordPress sites

Your API tokens, the apps connected through MCP and the connections of your WordPress sites keep working when you turn on two-factor sign-in. They are separate keys, not a sign-in, so they never ask for a code.

To create a token, approve an app or connect a site, you need to be signed in to the dashboard, so with two-factor sign-in on, those need a code too.

Turning on two-factor sign-in does not end tokens or apps that already exist. If you turned it on because someone else may know your password, review your tokens on the API page and your apps on the MCP page, and revoke or disconnect any you do not recognize. The audit log shows what they did.

Security emails

Scanfully emails the address you sign in with when:

• your sign-in email is changed (“The sign-in email of your Scanfully account was changed”). This one goes to your old address, and shows the new address and the IP address and browser the change was asked from;
• your password is changed, on the Security page or with a reset link (“The password of your Scanfully account was changed”);
• an authenticator is added (“An authenticator was added to your Scanfully account”);
• an authenticator is removed (“An authenticator was removed from your Scanfully account”). When it was the last one, the email says two-factor sign-in is now off;
• support resets two-factor sign-in (“Two-factor sign-in was reset on your Scanfully account”).

Each email says when the change was made and links to the Security page. The emails about your own changes also show the IP address and browser they came from.

Caution

If you get one of these emails for a change you did not make, reset your password right away with Forgot your password? on the sign-in page, check your authenticators on the Security page, and contact support.

In the audit log

Changes on the Security page appear in the audit log, with You, in the dashboard as who did it:

• Ask to change the sign-in email, with the new address, when you click Send links.
• Change the sign-in email, with the new address, once both links are opened. If you did not load the dashboard after opening the last link, Scanfully notices the change within a few minutes, and the entry shows Found by Scanfully as who did it.
• Change the password, on Password. A new password set with a reset link is listed too.
• Add an authenticator app, with the authenticator’s name.
• Remove an authenticator app, with the authenticator’s name.

A reset by support is not listed in your audit log; the email tells you about it.