Two-factor authentication (2FA): troubleshooting
To protect your home, every Gladys Plus account is secured with two-factor authentication (2FA): in addition to your password, Gladys Plus asks for a 6-digit code generated by an authenticator app on your phone (Google Authenticator, Microsoft Authenticator, 2FAS, Ente Auth...). This code changes every 30 seconds.
This code is asked when you log in on plus.gladysassistant.com, when you connect your local Gladys instance to Gladys Plus (in Settings > Gladys Plus of your instance), and for a few sensitive actions (generating recovery codes, changing your 2FA app, resetting your password).
This page lists the most common problems, and how to solve them.
My 2FA code is refused
If Gladys shows "Two Factor code is invalid", check the following points one by one: in the vast majority of cases, the problem is one of them.
1. The time on your phone is wrong
2FA codes are computed from the current time. If the clock of your phone is off by more than about 30 seconds, all the codes it generates are refused, even though they look perfectly fine.
Make sure your phone sets its date and time automatically:
- iPhone: Settings > General > Date & Time > turn on "Set Automatically".
- Android: Settings > System > Date & time > turn on "Set time automatically" (the exact menu can vary depending on the brand of your phone).
Then try again with a new code. Only the clock of your phone matters: the clock of your Gladys instance has no impact on 2FA codes.
2. You are using the wrong entry in your authenticator app
If you configured 2FA several times (for example after a reset, or when testing), your authenticator app may contain several entries related to Gladys. Only the most recent one works: the older ones generate codes that are refused.
Try the codes of each Gladys entry, one after the other. Once you found the right one, you can delete the obsolete Gladys entries of this same account from your app, to avoid any confusion. Keep the entries of your other Gladys Plus accounts, if you have several.
Also check that you are logging in with the right email address: each Gladys Plus account has its own 2FA.
3. The code expired while you were typing it
A code is only valid for a short time. If the code is about to change (most apps show a small timer), wait for the next code and enter it right away.
4. The code was not entered correctly
The code is made of 6 digits, without space. Some apps display the code as 123 456: type the 6 digits without the space. If you copy and paste the code, make sure no space or extra character was copied.
5. Too many attempts
After several wrong codes in a row, Gladys Plus may temporarily refuse new attempts ("Too many failed attempts"). Wait a few minutes, then try again with a new code.
I changed phone or reinstalled my authenticator app
2FA codes are generated from a secret stored in your authenticator app. If you change phone, or uninstall the app, this secret only follows you if your app synchronizes or backs up your accounts: otherwise, the new app won't generate valid codes.
First, check if your app can restore your accounts
Some authenticator apps save your accounts online: for example Google Authenticator when it is linked to your Google account, Microsoft Authenticator with its cloud backup, Ente Auth, or 2FAS with its backup. Install the same app on your new phone, then sign in or restore the backup. If your Gladys entry comes back, its codes work as before: you have nothing else to do.
Otherwise, it depends on whether you still have your old phone.
You still have your old phone
That's the easiest case. You have two options:
- Transfer your accounts from the old app to the new one, using the export feature of your authenticator app (most of them offer one, for example "Transfer accounts" in Google Authenticator).
- Register your new app on Gladys Plus: log in on plus.gladysassistant.com, go to Settings > Security, and click on "Change my two-factor app". Scan the QR code with your new app, then enter a code from your new app and a code from your old app to confirm. Once confirmed, only your new app will be accepted.
Keep your old phone until the change is confirmed!
You no longer have your old phone
If your app could not restore your Gladys entry, you can't generate 2FA codes anymore, but you can still log in with a recovery code (see below). Then contact us so that we reset the 2FA of your account: you will be able to configure your new app at your next login.
Using a recovery code
Recovery codes are single-use codes that let you log in when you don't have access to your authenticator app anymore. They are displayed only once: when you enable 2FA, and each time you generate a new set.
To use one, on the 2FA code screen, look for "Lost access to your two-factor app?" and click on on "Use a recovery code", and enter one of your codes. Each code can only be used once: cross it out once used.
Generate recovery codes (before you need them!)
If you never saved your recovery codes, or if you used most of them, generate a new set now, while you still have access to your authenticator app:
- Log in on plus.gladysassistant.com.
- Go to Settings > Security.
- Click on "Generate recovery codes", and enter a code from your 2FA app to confirm.
- Save these codes somewhere safe, outside of your phone: a password manager, or printed on paper. They won't be displayed again.
Generating a new set immediately invalidates your previous recovery codes.
After a 2FA reset
Gladys Plus is end-to-end encrypted. When your 2FA is reset, your encryption keys change, so your access to your Gladys instance is automatically revoked, for security reasons: your instance only accepts the keys you authorized at your home.
This is expected: on plus.gladysassistant.com, you will see the "One last step!" page again. To get your access back, open your Gladys instance locally, log in again in Settings > Gladys Plus, and authorize your user again in the "Remote users" section. The connection tutorial explains each step with screenshots.
Contact us
None of the solutions above worked? Write to us at [email protected] from the email address of your Gladys Plus account, so that we can identify your account, and tell us what you already tried.
You can also ask your question on the community forum.