Confirm it’s you
Copy for AI
Before a change that could hand your account to someone else, easySales asks you to prove again that you are at the keyboard. This stops someone who finds your computer unlocked from making those changes. How it fits with sign-in is on Sign-in security.
When you are asked
Section titled “When you are asked”- Creating a personal token for an AI tool.
- Creating a calendar subscription link — see Calendar.
- Changing your company’s plan or seats with Change now — see Change plan or seats.
- For an administrator: switching the company’s AI connection (MCP) on, or from Read only to Read and write.
- Turning on two-step verification, with an app or with email codes, and confirming a new email address for email codes.
- Generating new recovery codes.
- Adding or removing a passkey, and removing your authenticator app or email codes while keeping your passkeys.
- Changing your own password or sign-in email, when you use two-step verification.
- For an administrator: before changing another user’s email, resetting their password, resetting their two-step verification, or saving the company’s two-step verification settings.
- Start the change. The Confirm it’s you dialog opens.
- Confirm with what you have:
- Two-step verification on: select Use your passkey and unlock it on your device, or enter the 6-digit Verification code from your authenticator app. With email codes, select Send code and enter the code from the email. Without any of these, select Use a recovery code instead and enter one in Recovery code; that code is then used up.
- Two-step verification off: enter your Password.
- Select Confirm. The change you started goes ahead. Cancel closes the dialog and nothing changes.
What happens next
Section titled “What happens next”For the next 15 minutes, in this sign-in, easySales does not ask again. Signing in with a code or a passkey counts as confirming, so you are not asked straight after such a sign-in; signing in on a trusted device does not count. Another browser or device asks separately, signing out ends the 15 minutes, and after 15 minutes it asks again.
Rules to know
Section titled “Rules to know”| Situation | What easySales asks for |
|---|---|
| Personal token, calendar link, Change now on your plan, turning on 2FA, new recovery codes, adding or removing a passkey | Confirm it’s you, then 15 minutes free in this sign-in |
| An administrator changing another user’s email, password or 2FA, or the company settings | Confirm it’s you, then 15 minutes free in this sign-in |
| Changing your own password or email | Your current password every time; with 2FA, also Confirm it’s you with a code, passkey or recovery code, which the 15 minutes cover |
| Switching the company’s AI connection on or up | Confirm it’s you with a code, your passkey or a recovery code, unless you confirmed with one in the last 15 minutes |
| Approving an AI app | A code, your passkey or a recovery code, unless you signed in or confirmed with one in the last 15 minutes |
| Turning 2FA off | Your password and a code every time |
| Removing your last passkey | Your password, and the passkey or a recovery code, every time |
| Forget all trusted devices, Stop link on your calendar link, renaming a passkey | Nothing — none of them can open your account to anyone |
- With two-step verification on, your password alone never confirms it’s you.
- Too many wrong tries say Too many attempts. Try again in a few minutes.
Why it works this way
Section titled “Why it works this way”A signed-in screen is not proof of who is at it. Someone at a computer you left unlocked in a meeting room could otherwise create a token, add a passkey or change your email, and keep access long after you sign out. Asking again closes that gap.
With two-step verification on, the password is not enough. The password is the secret most likely to have leaked, so once you have a second step, only a code, a passkey or a recovery code confirms it’s you.
Fifteen minutes, in one sign-in. One confirmation covers a short run of changes, so you are not asked at every click. It stays with that sign-in in that browser and ends when you sign out, so it never carries over to a computer you used earlier.
Removing protection asks every time. Turning two-step verification off or removing your last passkey always takes your password and a proof, whatever you confirmed earlier, because that change would leave your account with only a password.
Work faster
Section titled “Work faster”- Make your security changes together. After one confirmation you have 15 minutes: add a passkey, generate new recovery codes and create a token in one go. See Connect an assistant.
- Sign in with a code or passkey before a batch of changes. That sign-in counts as confirming; a trusted-device sign-in does not. See Sign in.
- Confirm with your passkey. Use your passkey takes one touch instead of opening an app or an email. See Set up a passkey.
- Keep a recovery code for emergencies only. Every recovery code you use here is gone; use your app, email code or passkey when you have them. See Use recovery codes.
Examples
Section titled “Examples”Three changes, one confirmation. At 10:00 Mei Tan selects Add a passkey and confirms it’s her with a code from her app. At 10:05 she generates new recovery codes and at 10:12 creates a personal token; neither asks again. At 10:16 she creates a calendar link, and the dialog opens once more, because her confirmation ran out at 10:15 (10:00 + 15 minutes).
A trusted computer still asks. Daniel Lim signs in on his trusted office computer with his password alone. When he selects Add a passkey, Confirm it’s you asks for a code, because a trusted-device sign-in proved only his password. He enters the code from his app, and the passkey is added.
Common questions
Section titled “Common questions”- Why does easySales keep asking me to confirm it’s me? A confirmation lasts 15 minutes in one sign-in in one browser. Another browser, a new sign-in or a trusted-device sign-in asks again.
- Can I confirm with my password? Only while two-step verification is off. With it on, use a code, your passkey or a recovery code.
- How long does a confirmation last? 15 minutes, in this sign-in, in this browser. Signing out ends it.
- What if I don’t have my phone to confirm it’s me? Select Use a recovery code instead and enter one of your saved codes; that code is then used up.
- What does “Too many attempts. Try again in a few minutes.” mean? Too many wrong passwords or codes were entered in the dialog. Wait a few minutes and try again.
- Which changes ask me to confirm it’s me? Those that create a lasting way in or change how someone signs in: tokens, calendar links, passkeys, two-step verification, recovery codes, your sign-in email and password. For people who manage the company, also other users’ sign-in, the company’s security and AI settings, and Change now on the plan. The full list is above.