Skip to main content

Arculix Mobile app user guide

Intended audience: End users

Welcome to the Arculix Mobile app! The mobile app connects with the Arculix by SecureAuth multi-factor authentication (MFA) service to make logins more secure. Arculix Mobile generates login passcodes and sends you a push notification for one-tap authentication on your mobile device.

Supported authenticators include SMS, email, push, time-based one-time passcode (TOTP), security keys (like YubiKey, RFID, etc.), biometrics, security questions, FIDO authenticators, and passwords.

Accept or deny access in mobile app

Push notification view

arculix_auth_methods_diagram_logo.png

Operating system compatibility

The Arculix Mobile app is compatible with Android and iOS operating systems.

  • Android – Compatible on Android 8.0 or later

  • Apple – Compatible on iOS 13.0 or later

For any questions, concerns, or issues regarding the Arculix Mobile app, contact SecureAuth Support.

Download and install Arculix Mobile app

Android

In the Google Play Store, search for SecureAuth Arculix Mobile.

Google Play link: Arculix Mobile app?

Apple

In the App Store, search for SecureAuth Arculix Mobile.

App Store link: Arculix Mobile app

Pairing your device

Before you can use Arculix Mobile, you must pair your mobile device with Arculix. After you install and open the app for the first time, you will see the pairing screen. The pairing options are described next.

If you want to learn more about pairing or troubleshooting, see this section at the bottom of this topic: FAQs and troubleshooting

In line pairing

Your organization will provide instructions to use a QR code on a secure website.

You can then pair your mobile device by scanning the QR code.

Scan QR code in mobile app

Scan QR code to pair device

Email pairing

In the Arculix Mobile app, tap No QR Code? Sign Up! and enter your organization email to receive an email with instructions to pair.

At your workstation, open your email and use the Arculix Mobile app to scan the QR code in the body of the email.

arculix_mobile_pair_noQR.png

Scan QR code in body of email

Magic Link

You can use a Magic Link for fast pairing on your mobile device.

Open the Pair your device email sent to you on your mobile device and tap the universal link.

arculix_mobile_pair.png

Magic Link - tap to pair your device

There is a known Apple issue with universal links. Read more here and OpenRadar.

Dashboard view

View event history, paired mobile device and paired workstations, and profile settings.

At the bottom of the screen, tap the Dashboard tab. The key areas of the Dashboard page are described next.

User profile

Tap the user profile icon in the top right to make edits to your user profile in these fields:

  • Email. Email used to receive a one-time passcode.

  • Phone. Phone number to receive a one-time passcode via SMS or voice call.

  • Security Question. A factor to verify your identity in certain situations.

Fast Switch menu

The Fast Switch feature allows you to quickly switch accounts with one tap. This feature is available when you have more than one account paired in the app. See Multi-accounts for more information.

Fast Switch display information. Access to Fast Switch is hidden if you only have one account. When there is more than one account in the mobile app, the following rules occur:

  • Fast Switch displays only the email in the title bar for multiple accounts on the same server. For example, user01@acme.com

  • Fast Switch displays the email and the server name in the title bar, for multiple accounts from different servers. For example, user01@acme.com (M2M)

Workstations

Displays the number of paired workstations.

To view paired workstations, and to add or remove workstations, tap Workstations.

To learn more about the Workstations function, see Workstations

Devices

Displays the number of paired devices.

To view the paired devices, tap Devices.

Auth Profile Strength

Determines the strength of your authentication profile.

A number below 100% means your authentication profile is incomplete. This is configurable by your organization and used to establish device trust and enable secure lifecycle management.

To update your authentication profile strength, tap the shield icon.

Recent transactions

Dashboard list. Scroll up and down the page to view a history of authentication events.

Dashboard polling. Dashboard polling refreshes data for pending transactions instead using push notifications. This setting is activated on a policy set by your administrator.

Pending transactions. Transactions waiting for your approval are highlighted on the Dashboard.

arculix_mobile_dashboard_pending.png

Pending transaction is highlighted

arculix_mobile_app_002.png

Arculix Mobile for Android

arculix_mobile_app_002b.png

Arculix Mobile for iOS

QR scan

Scan a QR code to pair a mobile device and log in without a password.

At the bottom of the screen, tap the QR Scan tab. The key functions of the QR scan page are described next.

Pair a mobile device

You can pair a mobile device by scanning a QR code.

There are two ways to pair your device:

  • QR code on a secure website. Your organization might provide a secure website with a QR code to scan and pair your device. This is known as inline pairing.

  • QR code in email. When you sign up for an account in Arculix Mobile, you'll receive a Pair your device email with QR code.

Use passwordless login

You can scan a QR code for passwordless login on web pages that support Arculix Mobile login.

The web page must be set up for passwordless login by your organization.

Use offline login

You can scan a QR code that contains a time-based one-time password (TOTP) for offline authentication.

The web page must be set up for offline login by your organization.

Device camera scan

Coming soon! A new feature allows you to scan Arculix QR codes using the camera on your mobile device without first opening the Arculix Mobile app.

When you scan an Arculix QR code using your device camera, it will suggest opening the Arculix Mobile app. After the Arculix Mobile app opens, it automatically switches to the QR scan view in the app and seamlessly processes the QR code.

arculix_mobile_app_015.png

Coming soon! Use device camera to scan Arculix QR code

Scan QR code in mobile app

QR Scan tab in Arculix Mobile app

Offline code

Access time-based one-time passcode (TOTP) for offline logins.

Arculix has a zero-knowledge policy, so offline codes are stored only on the user device. Each time the user scans a new QR code, re-pairs an account, or a re-pairs workstation, it refreshes the offline codes. This prevents conflicts between new and old offline codes for the same account.

At the bottom of the screen, tap the Offline code tab. The key functions of the Offline Authentication page are described next.

Unlock Offline codes

This feature is in place when you have App Lock turned on in Arculix Mobile.

Your system administrator might have a policy that requires you to enter a passcode to view the offline code.

If this is the case, there is a label during the transaction request in Arculix Mobile that indicates it requires a passcode to unlock the offline code to complete MFA.

There is a label in the Account Settings that indicates whether there is a policy that requires the use of a passcode to unlock the offline codes.

TOTP Code

For offline login to your workstation or any TOTP-enabled web page, enter the TOTP code.

Access settings

To edit or delete the offline authenticator data, tap the pen icon in the top right.

Add offline authenticator

To add an offline authenticator, tap the + icon on the top right.

You can then scan a QR code or enter it manually.

arculix_unlock_offline_codes.png

Offline Code tab

Settings

Access app settings like sound, accounts, and help page. Some enterprise configurable settings are available.

At the bottom of the screen, tap the Settings tab. The key areas of the Settings page are described next.

General

Learn more about your version of the Arculix Mobile app or tap Help to be redirected to the Arculix Movile app user guide.

Preferences

Set your preferences for in-app notifications and language.

Arculix Lite switch. Optional feature set by your system administrator in Arculix. If this is available in the app, the slider allows you to switch the app into Basic Mode with a simplified display. The Basic Mode has only one screen (Dashboard) with access to QR scan and Settings.

Security

Add another layer of security by turning on App Lock. When you turn on this feature, it requires you to enter a passcode (PIN) or use biometrics like Face ID to approve an authentication request or to view offline codes.

arculix_mobile_app_applock_001.PNG

App Lock setting

When this option is turned on and the app detects a change in biometrics, like adding or removing a fingerprint on the mobile device, it will unpair all accounts.

Note

Be careful when changing biometric settings on shared devices.

Consider this scenario -- Alice has paired accounts in Arculix Mobile. Bob does not.

Alice and Bob share a mobile device. If Bob removes or adds a fingerprint, Arculix Mobile will unpair all accounts for Alice.

Alice will have to pair their mobile device again with Arculix Mobile.

You must turn on and set up a Passcode first before you can enable Face ID. The Passcode option is the fallback method in case the the biometrics method does not work.

arculix_mobile_app_applock_002.PNG

Turn on Passcode and Face ID in the App Lock settings

Your system administrator might have a policy that requires you to set an App Lock to view offline codes. If this is the case, you will receive a notification during MFA to turn on App Lock and set a passcode (PIN).

Depending on your organization settings, you'll set up a 4-digit or 8-digit passcode (PIN). If you've previously set up a PIN and there is a policy change, it might require you to change your PIN.

Note

Be sure to remember or securely store your passcode (PIN) in a safe place. If you forget your PIN, you will need to pair your device again.

Accounts

To edit or view your account settings, tap the account name. On the page for the selected account, you can do the following:

  • Location Trust. To allow the Arculix Mobile app to use your location in the background to generate a trust score, turn on Location Trust. This can minmize user friction and improve your login authentication experience.

  • Remove Account. Use this option to remove your account from Arculix Mobile.

    arculix_mobile_app_008.png

    Account view

To add another account, tap Add Account.

To unpair and remove this mobile device from your account in Arculix, tap Delete this device.

arculix_mobile_app_014.png

Settings tab

Workstations

Access the Workstation function to login, logout and lock your workstation.

On the Dashboard tab, tap Workstations tab. Tap a workstation name to do any of the following described next.

Use TOTP code

View the TOTP code for offline login to your workstation.

Log Out

To remotely close all applications running on your workstation and log out of your workstation, tap Log Out.

Lock

To remotely lock your workstation, tap Lock.

Settings (gear icon)

To unpair your workstation or to pin the workstation in the list, tap the gear icon.

Take note that if you unpair your mobile device from the associated workstation, you must re-pair your mobile device before the next log in to the workstation.

arculix_mobile_app_006.png

Workstations view

Multi-accounts

The Arculix Mobile app supports multiple accounts.

  • Add another account. You can add another account in any of the following ways:

    • Go to the QR Scan tab and scan a pairing QR code.

    • Go to the Settings tab, click Add Account, and scan a pairing QR code.

    • On your mobile device, open the pairing email and tap the Magic Link.

  • Switch accounts. Only one account at a time is selected and displayed in the app, like the transaction history on the Dashboard. However, you can switch accounts at any time. Use the Fast switch menu at the top of the Dashboard. Or, go to the Settings tab and switch accounts.

  • Working with multiple accounts. Some features work simultaneously for all accounts:

    • It shows all the TOTPs for each account on the app screen.

    • It displays the Push requests at any time and works for any account. It also displays which account the transaction request is tied to. You do not need to switch to a specific account to respond to incoming transaction requests.

    • When using the QR code scan, doing a web login, or pairing a workstation, it prompts you for which account the service belongs to.

arculix_multi-account_001.png

Multi-account view in Settings

arculix_multi-account_002.png

Select account when using QR code scan

Login methods

There are some ways to approve access to applications and your workstation in Arculix Mobile.

This depends on the policy settings set by your organization. The most common method is a push notification sent to your Arculix Mobile app, in which you can accept or deny access.

Push notification

A push notification is sent to your Arculix Mobile app. You can Accept or Deny the request.

Accept or deny access in mobile app

Push notification login method

Symbol Push

A symbol appears on your workstation screen. In the Arculix Mobile app, a row of characters display.

To approve access, tap the matching symbol in the Arculix Mobile app.

arculix_symbol-to-accept.png

Symbol Push login method

FAQs and troubleshooting

Read on to learn more or troubleshoot issues with the Arculix Mobile app.

I have a new phone. How do I pair Arculix Mobile app again?

Follow these instructions to pair your new device and remove the old device from your account.

  1. Go to the app store and install the Arculix Mobile app.

  2. When you open the Arculix mobile app, tap the No QR Code? Sign Up! and enter your organization email to receive an email with instructions to pair.

    arculix_mobile_pair_noQR.png

    Tap No QR Code? Sign up!

    Tip

    If your workstation uses Arculix Device Trust, you can use a different MFA to log in, like your password or SMS until you can pair your new mobile device with the Arculix Mobile app.

  3. At your workstation, open your email and use the Arculix Mobile app to scan the QR code in the body of the email.

  4. Once your phone is successfully paired, log in to your account in Arculix.

  5. In your account, for the old device, click Unpair Device.

I have a new phone. How can I log in to my workstation if it has Arculix Device Trust enabled until I can pair my new phone with Arculix Mobile?

Use another form of MFA like password or SMS to log in to your workstation. Then follow the steps in the previous FAQ to pair your mobile device again.

Arculix retains your paired user account data to Arculix Device Trust, so after your pair your new device with Arculix Mobile, you can continue to use the Push to Mobile function on the workstation login.

I have a rooted or jailbroken device. Can I pair my device with Arculix Mobile?

No. A warning message will display when you try to open the Arculix Mobile app: Arculix does not support modified devices. Please restore the device to factory settings in order to use this application.

Workaround: Restore your mobile device its factory settings and try again.

When I try to pair my device, why do I see this message: Arculix does not support modified devices. Please restore the device to factory settings in order to use this application?

Arculix Mobile has detected that the mobile device is rooted or jailbroken. The Arculix Mobile app will not work at all on rooted or jailbroken devices.

Workaround: Restore your mobile device its factory settings and try again.

When I try to pair my device, why do I see this message: This device cannot be paired with Arculix Mobile as your organization requires support for a hardware security module?

Your organization has a policy setting that requires built-in security features like Touch ID and Face ID on your mobile device.

arculix_mobile_rooted_device.png

Device does not meet your organization's security policy

Why am I getting this message in Arculix Mobile: "We have detected a change in the Face IDs on this device. For your security, Face ID was disabled in Arculix and you have been logged out."

arculix_mobile_app_016.png

Biometric change detected; Arculix Mobile unpairs all accounts

Arculix Mobile has a setting called App Lock. It lets you use biometrics like Face ID or fingerprint to approve an authentication request.

Workaround: Pair your mobile device again with Arculix Mobile.

When this option is turned on and the app detects a change in biometrics, like adding or removing a fingerprint on the mobile device, it will unpair all accounts.

Note

Be careful when changing biometric settings on shared devices.

Consider this scenario -- Alice has paired accounts in Arculix Mobile. Bob does not.

Alice and Bob share a mobile device. If Bob removes or adds a fingerprint, Arculix Mobile will unpair all accounts for Alice.

Alice will have to pair their mobile device again with Arculix Mobile.