A one-time code is a 6-digit number sent to the person a share is for, to prove it is really them before a control runs. It takes the place of the password check that a member of your organization would be asked for.
When a code is asked for
Reading a value, events or history never needs a code. Controls do:
- Shared by link: the first control in a session asks for a code. Security controls and live video ask again once the code is older than your organization's password window.
- Shared with a named person: security controls, safety-critical controls and live video ask for a code, and ask again once it is older than the window.
The window is the Password confirmation for security actions setting in Settings → Devices (IoT) → Safety and notifications. With Every security action, each security action needs a new code, entered within the last 2 minutes. With Every 15 minutes, a code counts for 15 minutes. With Every 60 minutes or Never, it counts for 60 minutes: a code is never switched off for a share.
In the share dialog, these controls are marked Needs a one-time code.
How it works
- For a link, the code goes to the email address or mobile number you entered when you made the share. For a named person, it goes to their account email.
- A code works for 10 minutes, for that share and that browser session only. The platform keeps only a fingerprint of it, never the code itself.
- Each code allows 5 tries.
- A new code can be asked for after 60 seconds, and at most 5 times an hour and 10 times a day for one share.
- If 3 codes are used up by wrong tries within an hour, the share's controls are paused for 60 minutes. The person can still look. The sender and the people with Manage IoT Sharing are told, and can choose Unlock on the share in Shared by us.
Choosing how codes are sent
When you share by link you choose Email, Text message or Don't send codes. Text message is offered only when your organization has a text-message line. A link that includes any control or live video needs Email or Text message.
Why not a password
People you share with have no password in your organization. A code to the address you chose shows that the person holding the link is the person you meant.
Where it is recorded
Each code sent, accepted or refused, and each lockout, is recorded in the share's uses: Code sent, Code accepted, Wrong code and Locked after wrong codes. See How to Revoke Shared Access for where to read them.
Related articles
Other guides that answer questions close to this one.
How to Open Device Access Someone Shared with You
Someone in another organization shared devices with you. This is how you open and use them. You can see and do only what was shared, until the time shown. If you received a link 1. Open the link in your browser. The…
How to Share Device Access with a Link
Give someone without an account, such as a plumber or a guest, a link that opens only the functions you choose until a date you choose. Before you start You need the Manage IoT Sharing right, and you can share only what…
How to Share Device Access with a Named Person
Share exact functions of exact devices with a named person outside your organization, until a date you choose. The person can be a member of another organization or a member of the platform's own team. They open what…
How to Revoke Shared Access
End a share at any moment. It stops working at once, wherever it is open. Before you start You need the Manage IoT Sharing right. You can end any share your organization made, not only your own. End a share 1. In…