How to Set Up 2FA and Get a Secret Key for Dashboard Apps

How to Set Up 2FA and Get a Secret Key for Dashboard Apps

This document explains how to configure 2-Factor Authentication (2FA) for services that require it and retrieve the necessary 'Secret Key' for the Pickcel Dashboard App.

Why do I need a Secret Key instead of a QR Code?

The Pickcel Dashboard App uses a server with a headless browser to log into your services automatically. Because the server cannot manually enter a 6-digit TOTP during login, you must provide the TOTP secret key (obtained via the service’s “manual setup”/“can’t scan?” option). Pickcel stores this key securely and generates the TOTP server-side whenever it signs in.

General Steps to get the Secret Key:

When you enable 2FA in services like Atlassian (Jira/Trello), Microsoft (Power BI), Salesforce, or Zendesk, you will be presented with a QR code. Instead of scanning it, look for an option like "Manual setup," "Can't scan the code?," or "Show secret key."

This will reveal a long string of text. This is your Secret Key (also sometimes called Authenticator Secret or Auth Secret).

Instructions:

1. Start the 2-Factor Authentication setup process in your desired service (e.g., Salesforce, Power BI).
Notes
For detailed, step-by-step instructions from the service providers, please refer to their official documentation:
  1. Jira/Atlassian:How to set up two-step verification
  2. Microsoft/Power BI:How to use two-step verification with your Microsoft account
  3. Salesforce:Enable MFA for Your Users
  4. Zendesk:Enabling two-factor authentication
2. When the QR code appears, find and click the "Can't Scan the Code"/"Show Secret Key" (or similarly named) option.
3. Copy the Secret Key that is displayed on the screen.
4. Store this key in a secure location. Treat it with the same level of security as your main password.
5. Paste this key into the corresponding "Auth Secret" or "Authenticator Secret" field in the Pickcel Dashboard App configuration.
6. Complete the 2FA setup on your service's website, by entering a code generated by an authenticator app using the same secret key