Search

Login Authentication

What's Changing?

We upgraded our login system in early 2026 to provide better security for your account and data. 

What You Need to Do When Signing In

First Time After Launch:

  1. Go to your usual Brushfire login page - you'll be automatically redirected to our new login portal
  2. Enter your email address first, then:
    • Use your existing password, OR
    • Sign in with Google/Apple if you used those before
  3. Verify your email and reset your password (one-time step for security)
  4. Enable Two-Factor Authentication when prompted - this adds an extra security layer to your account- Required.

Two-Factor Authentication

When you or your team goes to sign in, they’ll see four options. Each one meets the new security requirement a little differently:

  1. Email and password
    They enter their email and password, then confirm it’s really them with one of these:
    • Authenticator app: a free app like Microsoft Authenticator that shows a code
    • Text message: a code sent to their phone. ONLY AVAILABLE FOR US AND CANADA. 

    They only set this up once, and they can choose to have each device remembered for 30 days.

  2. Continue with a passkey
    No password needed. They sign in with their fingerprint, face, or device PIN on a phone or computer they’ve already set up. The passkey covers the security step on its own, so there’s nothing extra to do.
  3. Continue with Google or Apple
    They sign in with their existing Google or Apple account, which handles the security for them. We recommend turning on 2-step verification for those accounts.

Where you control this

Admins can see and adjust which sign-in options are available in your Dashboard under [Organization Settings > Security Settings].

Data Viewers and Scanners
If you have team members with the Data Viewer or Scanner role, you can choose to let them skip the extra security step. This can help with things like shared check-in devices or team members who only need to view reports. To turn it on, an admin opens that person’s user profile and checks the box that says “Allow this user to bypass all multi-factor authentication requirements.” This option is only available for these two roles; everyone else will need MFA.

Important Changes That May Require Action

Real emails are required! All user accounts must use verified, real email addresses including for check-in or report viewers. 

Setting Up Check-In Access for Multiple Devices

Previously, many organizations shared a single scanning account across multiple devices and team members. As we strengthen account security to protect your event data, this method will no longer work.

Based on your event type and frequency, here are our recommended best practices for managing multi-device access:

Option 1: Temporary Event Staff/Devices

Best for: Festivals, conferences, or sporting events with volunteers

Use the Copy Settings to Other Devices feature to grant temporary access without sharing passwords. As always, make sure you have the latest version of the Brushfire App from the store.

  1. Sign in on your primary device
  2. Select "Copy Settings" from the menu to generate a QR code
  3. On the other device, sign out to the main sign-in screen, and then tap Copy Device Configuration.
  4. Scan the code on the first device for instant check-in access
  5. Volunteers log out when the event ends

Option 2: Regular Staff Operations

Best for: Venues with daily operations and consistent staff

Create role-based email accounts for different functions:

  1. Set up dedicated emails that are easy to identify (e.g., scanning@yourvenue.com, boxoffice@yourvenue.com)
  2. Verify each email in Brushfire
  3. Share credentials with the appropriate team members
  4. Each device signs in using the relevant role-based account
  5. If you also have rotating volunteers or multiple devices at each location, then they can still use the QR code method above. 

Benefits of these approaches:

  • Easy password management (change one password instead of 50)
  • Clear audit trail by function
  • Simple permission management by role
  • Quick access removal when staff changes

Security Note: While individual accounts provide the highest security, these methods balance protection with operational efficiency based on your event needs.

Need Help?

If you have trouble signing in or need to update your email address, contact our support team. We're here to help make this transition smooth for you.