Les articles d'aide existent en allemand et en anglais. Vous les lisez ici en anglais.
Utilisateurs, rôles et formules
Set up two-step verification
In the settings you set up a code from an authenticator app or a passkey. After your password, sign-in then asks for the code or the passkey. Ten recovery codes cover the case where you have neither at hand.
How do I protect my account beyond the password?
Your account sees budgets, revenue and, through conversion forwarding, the credentials for the ad platforms. A password alone is not enough for that: it can be guessed, intercepted or carried over from another service. An additional code from the app protects your account if someone only knows your password. It is valid only briefly and works only once.
- 01Open the settings and choose “Set up” under “Two-step verification”.
- 02Enter the secret shown into your authenticator app, or scan the address as a QR code.
- 03Enter the six-digit code from the app and switch it on.
- 04Write down the ten recovery codes and keep them separate from your phone.
Caution
The recovery codes appear exactly once. What we store is their checksum; we cannot show them again later. Without them and without your phone you will not get back into your account.
Instead of the app, or in addition to it, you can add a passkey. It counts as a second step in the same way: your first passkey switches on two-step verification, even without the app, and you get ten recovery codes if you have none yet. It also signs you in without a password. How that works is explained in “Sign in with a passkey”.
What to know
- The code in the app changes every thirty seconds; each one can be used only once.
- If your phone’s clock is wrong, the codes will not match. Set it to automatic time.
- Each recovery code works exactly once; the settings show how many are left.
- Switching it off needs your password and a code: a hijacked session alone should not remove the protection.
- Switching it on and off is recorded in the change log of every tenant you belong to, and its admins see it.
Caution
A one-time code can be phished too: a fake sign-in page can ask for your password and code and pass both on at once. So enter the code only on the genuine Metrunio sign-in page and never in an email, a chat or on the phone, not even if someone claims to be support. We never ask for it.
The setting applies to your account, not to the tenant. Everyone decides for themselves, and should decide in favour.
Dernière vérification le 16 oct. 2026
Dans le portail client
Également demandé
- Two-factor authentication
- Set up 2FA
- How do I protect my account?
- Connect an authenticator app
- I lost my phone
- Passkey as a second factor
Articles connexes
- Sign in with a passkey
How do I sign in without a password?
Add a passkey under “Settings” → “Security”. After that you sign in with “Sign in with a passkey” without a password, using your fingerprint, face or your device’s PIN. A passkey also counts as the second step when you sign in with your password.
- Signing in without your phone or passkey: recovery codes
How do I sign in when my phone or passkey is not at hand?
After your password, choose “Use a recovery code” and enter one of the ten codes you wrote down during setup. Each works exactly once. Without your phone or passkey and without an unused code there is no way back into this account.
- Sign-in, password and Google access
I cannot get into my account. What now?
Use “Forgot your password?” to reset it yourself; the link arrives by email. Signing in with Google Workspace is also possible, provided it is enabled for your tenant. It comes with Scale and the agency plan.
- Which roles exist and what may they do?
Who is allowed to do what in the portal?
There are three roles inside a tenant (Admin, Analysis and Read only) plus two platform-side roles. Every API route checks the permission server-side; hiding things in the interface is only the display of that.
- Who changed what?
How do I check who changed a setting?
The change log records changes with person, time and action, plus the security of user accounts, for example who switched off two-step verification or suspended someone’s access. It is visible to the Admin role; each entry is kept for 180 days.