Octavia

Knowledge Base

Browse step-by-step guides for every part of Octavia, with clear navigation and search to help you find what you need fast.

Family Hub155 linked articles

Multi-Factor Authentication for Families

Parents can be asked for a six digit code from an authenticator app, as well as their password, when they sign in to the Family Hub. Your school administrator switches this on for your school (see Multi Factor Authentica

How It Works for Parents

Multi-factor authentication (MFA) adds a second check to signing in: after the password, the parent types a six-digit code from an authenticator app on their phone. The codes change every 30 seconds. Someone who learns only the password can't sign in to the Family Hub without the code.

A school administrator switches MFA on for the school, in Settings, School settings, Two-step sign-in (MFA). A new school starts with it off, and families at a school where it hasn't been switched on see nothing different. Once it is on, parents have 7 days' notice, and a parent creating a new account or changing their password needs at least 8 characters instead of the 14 that apply while it is off.

When it is switched on for your school, parents go through two stages:

  • A notice period. A banner appears at the top of the parent's Hub home page and school page: "Two-step sign-in becomes required for your school on [date]." with a Set it up now button. Nothing is blocked. A parent can set it up straight away or choose Not now.
  • Required. After that date, a parent who hasn't set it up sees a set-up screen the next time they open the Hub, before they can use anything else.

What a Parent Does

  1. Installs an authenticator app on their phone if they don't have one. Google Authenticator, Microsoft Authenticator and the built-in Passwords app on iPhone and Mac all work.
  2. Scans the square code on the set-up screen. If they're signing in on the same phone and can't scan it, they select Copy key and paste the setup key into the app.
  3. Types the six-digit code the app shows for Octavia.
  4. Saves their recovery codes, which Octavia then shows. See Save Your Recovery Codes.

There is a step-by-step guide with screenshots that you can send to families: How to set up multi-factor authentication (MFA) for your Octavia account. Parents use the same steps, and find their devices under Settings in the Hub.

From then on, after entering their password, the parent types a code from the app. If they have more than one device, they choose which one.

A new parent at a school that requires MFA meets this screen straight after setting their password, so it helps to tell them to expect it.

Things That Aren't Affected

  • Students. The parent switch doesn't change how students sign in. Students have their own switch on the same card (see The Student Hub), and at a school that hasn't switched it on they sign in as before. The one thing to know is that MFA belongs to the login: someone who is both a parent and a student has one authenticator and one set of recovery codes, and if either their parent school or their student school requires it, they set it up once and are asked for a code whichever way they use the Hub.
  • Links in emails. News items, performance pages, consent forms, availability requests, payment links and similar links open without a code, as they do today.

A Parent With More Than One School

MFA belongs to the parent's login, not to a school. A parent with children at two studios has one authenticator and one set of recovery codes. If any of the schools they belong to requires MFA, they set it up once and it covers all of them.

This means a parent may be asked to set up MFA, or be given a notice, even though your school hasn't switched it on, because another school they belong to has. If a parent asks why, that is usually the reason.

If you've revoked a parent's Hub access at your school (see Managing Family Hub Access), your school no longer counts toward whether they have to use MFA. A parent who has already set up an authenticator is still asked for a code whenever they sign in.

What You Can and Can't Do

  • You can't see whether a parent has set up MFA, and you can't set it up, change it or reset it for them.
  • You can tell families what to expect, point them to the steps above, and encourage them to save their recovery codes. Recovery codes are how families get back in if they lose a phone.

If a Parent Loses Their Phone

Parents can get back in themselves with one of their recovery codes, so most of the time you won't need to do anything.

On the code screen the parent selects Use a recovery code and enters a code they saved. Octavia removes their old authenticator and signs them out. They sign in again with their password, set up a new authenticator on their new phone, and get a new set of recovery codes. See Save Your Recovery Codes.

That's why it matters to remind families to save their codes when Octavia shows them.

If a parent has lost their codes too, there is still a last resort. Ask the parent to tell you, then email info@octavia.studio with the parent's name and the email address on their Octavia account. Octavia checks that the request really comes from the parent, for example by contacting the studio, before resetting their MFA, so it takes longer than a recovery code. A message alone isn't enough.

Helping Families Get Ready

  • Tell families before the date, so the set-up screen isn't a surprise.
  • Remind them to save their recovery codes the moment they're shown. Octavia only shows them once.
  • Suggest adding a second device.
  • Remind them that a screenshot of the codes on the same phone won't help if they lose that phone.

Previous: Calendar Subscriptions in the Family Hub