Skip to content
Tobren Operations Docs

Account & security

This page covers how your individual account is secured — signing in, two-factor authentication, and getting back in if you lose your second factor — and what it looks like the first time you accept a crew invite. It’s written for anyone with a Tobren Operations login, not just admins.

Two-factor authentication (2FA)

Section titled “Two-factor authentication (2FA)”

If you signed up with an email and password, Tobren Operations requires a second factor on top of your password — it’s what keeps your fleet’s records yours alone if your password ever leaks. If you signed in with Google or Apple instead, your account skips this: sign-in security is delegated to that provider.

The first time an email/password account signs in, you’re walked into setup before you can reach the workspace. Choose one of two methods:

  • Authenticator app (recommended) — scan a QR code with Google Authenticator, 1Password, Authy, or any TOTP app, then confirm with the 6-digit code it generates. Works without cell service.
  • Text message — get a 6-digit code by SMS each time you sign in.

Once enabled, every sign-in asks for a fresh code from whichever method you set up.

Requiring two-factor for your whole team

Section titled “Requiring two-factor for your whole team”

An Admin or the Account owner can turn on Require two-factor under Settings → Security. It covers owners and admins who sign in with a password, including the person turning it on. It takes effect at each person’s next sign-in; nobody already signed in is signed out. Google and Apple sign-ins are not affected, because the provider owns their second factor. Turning it off asks you to confirm it’s you again. The Account owner can also reset a teammate’s two-factor from their crew page (Access panel, Reset two-factor).

Recovery codes

Section titled “Recovery codes”

Right after you enable two-factor authentication you land on Save your recovery codes. Press Confirm it’s you (you may be asked for your password or provider again) and Tobren Operations generates 8 recovery codes and shows them to you once. Each looks like K7QF-9MNX-PR4T-H2WD.

You can’t move on until you’ve both copied and downloaded them — the app holds you on that screen until it’s sure you have a copy somewhere safe. Each code works exactly once. Using one to recover your account removes your second factor and retires the rest of the set; you save a fresh set afterwards. Recovery codes are shared across Tobren products, so recovering also turns the factor off in them.

There’s no way to view or regenerate your recovery codes later from the app. They’re shown exactly once, right after you set up (or reset) your second factor. Store them somewhere durable — a password manager, printed and filed — the same way you’d store any other one-time credential.

Getting back in if you lose your device

Section titled “Getting back in if you lose your device”

If you lose your authenticator app or your phone, choose Can’t access your authenticator? on the sign-in screen (or Use a recovery code at the code prompt), which opens the Recover your account page. There are two ways in:

  • Recovery code — enter one of the 8 codes you saved at enrollment.
  • Email recovery — Tobren Operations emails an 8-digit one-time code to your account’s address. It expires in 15 minutes.

Either path does the same thing, and it’s worth understanding exactly what: it removes the second factor from your account and nothing else. It does not sign you in, and it does not touch or reveal your password. You still sign in normally with your email and password afterward, and — because you no longer have a second factor enrolled — you’re walked straight back into 2FA setup, where you’ll save a fresh set of 8 recovery codes.

Recovery attempts are rate-limited, so repeated wrong codes or OTP guesses lock out for a period rather than allowing unlimited tries.

Accepting a crew invite

Section titled “Accepting a crew invite”

If an admin invites you onto their roster, you’ll get an email with a link shaped like /invite/pilot/<token>. That link is single-use and expires 7 days after it’s sent — if it’s gone stale, ask whoever invited you to send a new one.

Opening the link:

  1. If you’re not signed in, you’re sent to sign in (or create an account) first, then brought straight back to finish accepting.
  2. Once you’re signed in, the invite links your account to the pilot record the admin already created for you — you’re on the roster the moment your invite was sent; accepting is what connects it to your own login.
  3. You land on a confirmation screen and then your workspace, where you can see your flights, currency status, and assignments.

If the link has expired, the page says so; if it is invalid, it says it may already have been used. Either way it gives you a way out — either sign out (if you’re signed in as the wrong account) or go to your workspace if you already have access another way.

What’s next

Section titled “What’s next”