# Adding your authenticator

> Signing in to Cartoo takes your emoji-PIN and a 6-digit code. How to get that code onto your phone, Mac or desktop — and what to do when the shortcut does nothing.

Signing in to Cartoo takes two things: the **emoji-PIN** you chose, and a
**6-digit code** that changes every 30 seconds. The code comes from an
authenticator — an app on your phone, or a feature already built into the device
you are reading this on.

You set this up once, on the screen that says *Add your authenticator*. That
screen shows you three ways to do it, and they all reach the same place:

- a **button** that hands the code straight to whatever is on the device
- a **QR code**, for pointing another device's camera at
- a **setup key**, which works everywhere and cannot fail silently

If the button does nothing, use the setup key. That is what it is there for, and
the rest of this page is mostly about when that happens.

:::caution
The setup screen appears **once**, from a one-time invite link. Do not slide to
confirm until your authenticator is actually showing a 6-digit code for Cartoo.
:::

## iPhone

iOS has an authenticator built in — **Settings › Passwords**, under *Verification
codes*. It needs no download.

1. Tap **Add to iPhone** on the setup screen.
2. iOS opens Passwords and asks which entry to attach the code to. Choose your
   Cartoo entry, or let it create one.
3. Go back to Cartoo and slide to confirm.

To read your code later: **Settings › Passwords › Cartoo**. The 6-digit number
under *Verification code* is what the sign-in screen wants.

If you would rather use Google Authenticator, Microsoft Authenticator, 2FAS or
Aegis, install it first — then the button opens that app instead.

## Android

Android has nothing built in, so an app is required. **Google Authenticator**,
**Microsoft Authenticator**, **2FAS** and **Aegis** all work; any app that says
"TOTP" or "authenticator" will.

1. Install one from Google Play.
2. Tap **Add to authenticator** on the setup screen. The app opens with the
   account already filled in — confirm it.
3. Go back to Cartoo and slide to confirm.

If the button opens nothing, no authenticator is installed yet. Install one and
tap it again, or use [the setup key](#typing-the-key-in-by-hand).

## Mac

macOS keeps verification codes in **Passwords** (System Settings › Passwords, or
the Passwords app on Sonoma and later).

1. Click **Add to Passwords** on the setup screen.
2. Passwords opens.

**Check that a code actually appeared.** In our testing the Mac opened Passwords
and added nothing — the *Codes* list stayed empty. A shortcut that opens the
right app and then quietly does nothing is worse than one that fails, because it
looks like it worked. So look before you slide.

If no code appeared, add it by hand:

1. In Passwords, select the Cartoo entry (or create one).
2. Choose **Set Up Verification Code… › Enter Setup Key**.
3. Paste the setup key from the Cartoo screen — the **Copy** button next to it
   puts it on your clipboard.

You can also point your phone's camera at the QR code instead. On a Mac that is
often the faster route.

## Choosing an app

On a Windows or Linux desktop the code has to live somewhere else, because the
desktop has no authenticator of its own. Use the phone you already carry:

- **Google Authenticator** — simplest, free, iOS and Android.
- **Microsoft Authenticator** — same, plus cloud backup.
- **2FAS** or **Aegis** (Android) — open source, exportable backups.
- **1Password**, **Bitwarden**, **Proton Pass** — if you already pay for a
  password manager, it almost certainly does verification codes too.

Any of them will scan the QR code on the setup screen. There is nothing
Cartoo-specific to install.

:::tip
Whatever you pick, make sure you can restore it if you lose the phone. An
authenticator with no backup means an authenticator you can lose — and a lost
one has to be reset by your dealer.
:::

## Typing the key in by hand

The **setup key** is the same secret the QR code and the button carry, written
out so a person can read it. It works in every authenticator ever made, and it
is the route to use when anything else misbehaves.

On the setup screen, tap the row of dots to reveal it, or press **Copy**.

Then, in your authenticator, look for:

- **Enter a setup key** (Google Authenticator)
- **Enter code manually** (Microsoft Authenticator)
- **Enter Setup Key** (Apple Passwords)

Paste or type the key. Leave everything else at its default — time-based,
6 digits, 30 seconds, SHA1. If the app asks for an account name, anything you
will recognise is fine; it is a label, not part of the secret.

The key is shown **once**. After you sign in it is gone, and a replacement can
only be issued by your dealer.

## If it goes wrong

**The code is rejected.** Check your device's clock is set automatically — a
phone a minute out of step produces codes the server has already expired. On
iOS: *Settings › General › Date & Time › Set Automatically*.

**You slid to confirm too early and the authenticator is empty.** The invite is
spent, so the link will not open again. Ask your dealer to reset your
authenticator — your emoji-PIN is kept, and only the code generator is replaced.

**You lost the phone.** Same answer, and the old authenticator stops working the
moment the new one is issued.