Why live changes need a code

Anything that changes your live site asks for a code from an authenticator app. One code covers the next 20 minutes.

Needlr can change your live website through your Tag Manager. So before any change reaches your visitors, it asks for a 6-digit code from an authenticator app on your phone.

Think of a bank vault

A bank vault needs two things to open: a key, and a code that only the manager knows. A thief with just the key still can't get in.

Your password is the key. The code on your phone is the second lock. Someone who steals your password still can't change your site.

Which actions ask for a code

• Choosing your Tag Manager container (this installs Needlr's snippet on your site). Signing in to Google to connect doesn't need one: Google's own screen does that job (more).
• Publishing to Tag Manager, and rolling a publish back (more).
• Starting or stopping an impact check that changes your site. A past release measured with Google Analytics changes nothing on the site, so it needs no code.
• Shipping a winner to everyone, showing version A to everyone again, and most other steps on Shipped changes (more).
• Disconnecting Tag Manager, and deleting a project that's connected to it (both remove Needlr's tags from your site).
• For coding agents: connecting one, a new key, a webhook, resuming one, or letting its split tests start on their own (more).

Owners and editors do these things, so they're the ones who need an app. Viewers never change anything, so they never need a code.

The 20 minutes

Once a code is accepted, you're covered for the next 20 minutes. In that time, the same dialog only asks you to press Confirm. After 20 minutes, it asks for a new code.

Signing in with a code, setting up the app, or using a recovery code also starts the 20 minutes. Signing out ends them.

Setting it up

You don't need to do this ahead of time. The first time an action needs a code, Needlr sets it up right there in the dialog.

1. 1Install an authenticator app on your phone, for example 1Password, Google Authenticator or Authy.
2. 2When Needlr shows Protect your account first, scan the square with the app. Can't scan? Press Can't scan? Enter this key instead and type the key into the app.
3. 3Type the 6 digits the app shows and press Turn on.
4. 4Needlr shows your recovery codes. Copy them somewhere safe, tick I saved these codes somewhere safe., and press Continue.
5. 5Your change goes through. You're covered for the next 20 minutes.

If you lose your phone

When Needlr asks for your code, before a live change or at sign-in, press Lost your phone? Use a recovery code and type one of your recovery codes. It counts as your code for the next 20 minutes. Each code works once, and Needlr never shows them again, so keep them in a password manager.

Right after, Needlr offers Set up a new authenticator. Scan the square with the app on your new phone and type the 6 digits. Your old app and old recovery codes stop working, and you get 10 new codes to save (more).

Common mistakes

• Typing an old code. Codes change every 30 seconds, and each one works once. Wait for the next one.
• Pressing Cancel. Nothing was changed. Do the action again when you have your phone.
• Keeping recovery codes on the same phone only. If the phone is lost, so are they. Save them in a password manager too.
• Too many wrong codes in a row. Needlr says Too many attempts. Wait a few minutes and try again. Wait, then use a fresh code.