Adding your authenticator

Signing in to Cartoo takes two things: the emoji-PIN you chose, and a 6-digit code that changes every 30 seconds. The code comes from an authenticator — an app on your phone, or a feature already built into the device you are reading this on.

You set this up once, on the screen that says Add your authenticator. That screen shows you three ways to do it, and they all reach the same place:

• a button that hands the code straight to whatever is on the device
• a QR code, for pointing another device’s camera at
• a setup key, which works everywhere and cannot fail silently

If the button does nothing, use the setup key. That is what it is there for, and the rest of this page is mostly about when that happens.

Caution

The setup screen appears once, from a one-time invite link. Do not slide to confirm until your authenticator is actually showing a 6-digit code for Cartoo.

iPhone

iOS has an authenticator built in — Settings › Passwords, under Verification codes. It needs no download.

1. Tap Add to iPhone on the setup screen.
2. iOS opens Passwords and asks which entry to attach the code to. Choose your Cartoo entry, or let it create one.
3. Go back to Cartoo and slide to confirm.

To read your code later: Settings › Passwords › Cartoo. The 6-digit number under Verification code is what the sign-in screen wants.

If you would rather use Google Authenticator, Microsoft Authenticator, 2FAS or Aegis, install it first — then the button opens that app instead.

Android

Android has nothing built in, so an app is required. Google Authenticator, Microsoft Authenticator, 2FAS and Aegis all work; any app that says “TOTP” or “authenticator” will.

1. Install one from Google Play.
2. Tap Add to authenticator on the setup screen. The app opens with the account already filled in — confirm it.
3. Go back to Cartoo and slide to confirm.

If the button opens nothing, no authenticator is installed yet. Install one and tap it again, or use the setup key.

Mac

macOS keeps verification codes in Passwords (System Settings › Passwords, or the Passwords app on Sonoma and later).

1. Click Add to Passwords on the setup screen.
2. Passwords opens.

Check that a code actually appeared. In our testing the Mac opened Passwords and added nothing — the Codes list stayed empty. A shortcut that opens the right app and then quietly does nothing is worse than one that fails, because it looks like it worked. So look before you slide.

If no code appeared, add it by hand:

1. In Passwords, select the Cartoo entry (or create one).
2. Choose Set Up Verification Code… › Enter Setup Key.
3. Paste the setup key from the Cartoo screen — the Copy button next to it puts it on your clipboard.

You can also point your phone’s camera at the QR code instead. On a Mac that is often the faster route.

Choosing an app

On a Windows or Linux desktop the code has to live somewhere else, because the desktop has no authenticator of its own. Use the phone you already carry:

• Google Authenticator — simplest, free, iOS and Android.
• Microsoft Authenticator — same, plus cloud backup.
• 2FAS or Aegis (Android) — open source, exportable backups.
• 1Password, Bitwarden, Proton Pass — if you already pay for a password manager, it almost certainly does verification codes too.

Any of them will scan the QR code on the setup screen. There is nothing Cartoo-specific to install.

Tip

Whatever you pick, make sure you can restore it if you lose the phone. An authenticator with no backup means an authenticator you can lose — and a lost one has to be reset by your dealer.

Typing the key in by hand

The setup key is the same secret the QR code and the button carry, written out so a person can read it. It works in every authenticator ever made, and it is the route to use when anything else misbehaves.

On the setup screen, tap the row of dots to reveal it, or press Copy.

Then, in your authenticator, look for:

• Enter a setup key (Google Authenticator)
• Enter code manually (Microsoft Authenticator)
• Enter Setup Key (Apple Passwords)

Paste or type the key. Leave everything else at its default — time-based, 6 digits, 30 seconds, SHA1. If the app asks for an account name, anything you will recognise is fine; it is a label, not part of the secret.

The key is shown once. After you sign in it is gone, and a replacement can only be issued by your dealer.

If it goes wrong

The code is rejected. Check your device’s clock is set automatically — a phone a minute out of step produces codes the server has already expired. On iOS: Settings › General › Date & Time › Set Automatically.

You slid to confirm too early and the authenticator is empty. The invite is spent, so the link will not open again. Ask your dealer to reset your authenticator — your emoji-PIN is kept, and only the code generator is replaced.

You lost the phone. Same answer, and the old authenticator stops working the moment the new one is issued.