Online Portal

Two-factor authentication

• What does two-factor authentication actually mean?

  It means that you do not just log in with your e-mail address and your password but that there is a second factor on top of that. This may be a code which is generated, for example, via smartphone or is sent out by e-mail. So, even if someone does know your password, he or she cannot log in to your account.

• Why do I need the two-factor authentication?

  The second factor for login protects your sensitive data from unauthorised access. Even if someone has obtained your access data (e-mail address and password), they cannot get into the Online Portal with it.
  
  A 2-factor authentication (in short: 2FA) is state-of-the-art today when it comes to online security.

• Do I need a smartphone for the two-factor authentication or is it sufficient to use my laptop?

  No, the 2FA also works without a smartphone, e.g. with the factors e-mail and desktop app “Okta Verify”.

• Which two-factor authentication methods can I use to log in to the GEMA online portal?

  As a GEMA member, you have four verified methods available for two-factor authentication on the GEMA online portal.

  • You can receive the one-time code by email at your registered address.
  • Alternatively, the Okta Verify desktop application generates an automatic token for verification.You generate the code by using an app on your smartphone
  • The Okta Verify mobile app on your smartphone also generates time-based one-time codes.
  • As a fourth option, you can receive a push notification directly on your registered mobile device.

  All methods comply with the GEMA security standard for access to protected member areas and work usage data. 

• Is there a particular method you would recommend for GEMA’s two-factor authentication registration? Which is the most secure?

  Several methods are available for two-factor authentication on the GEMA online portal: the Okta Verify app, SMS codes and hardware tokens. All three methods comply with the OAuth 2.0 security standard and are approved for use in the login process. The Okta Verify app offers the advantage of push notifications and works on both mobile devices (iOS, Android) and desktop systems (Windows, macOS). SMS codes are sent to the mobile number on file with GEMA and are valid for 5 minutes. Hardware tokens generate time-based one-time passwords (TOTP) and do not require an internet connection.

• If I have decided to use a different method, can I still switch to another one at a later point in time?

  Yes, we even recommend that you set up several authentication methods in case that you lose access to one of them (e.g. in case you lose your smartphone). You can set up all methods independently and decide which one to use each time you log in, if you wish to do that.

• Why can publishers or sister organisations not use all available login methods (i.e. the same as, for example, composers and lyricists)?

  Once again, the security of accessing the data is paramount. After all, we cannot ensure that each publisher or each sister society or organisation provides a company mobile to all its employees. This is why logins using mobile phone are excluded.
  
  You will therefore receive the link/code for authentication purposes by e-mail.

• What happens if I am a creator and a publisher?

  If you are a creator and if you also run a publisher, you can use all the options for creators.
   
  If, at some point in time, you are only holding a publishing role, restricted options will apply.

• Can I receive the code on my mobile when I am abroad?

  You can also have the code sent to your mobile when you are abroad. What is important, though, is that your mobile is connected to the internet.

• Can I deactivate the two-factor authentication as a creator?

  As a GEMA member and/or employee of a sister society/organisation, the two-factor authentication method is mandatory and cannot be waived.

• Can I continue to use the Online Portal in future without the 2FA method?

  As a GEMA member and/or employee of a sister society/organisation, using the two-factor authentication method is mandatory and cannot be waived. For music users, logging in with the 2FA method is still optional but recommended.

• I did not receive my conformation e-mail. What can I do?

  Please also check your spam folder. If you do not find an e-mail in it, please click on Send again. It is possible that sending the mail takes up to three minutes.

• I manage creators. How can I log in to their accounts?
  Online Portal access is personal, i.e. person-based. You first need your own access as GEMA member. 
  
  As soon as you have successfully registered, the Activate online services screen appears and the question: In which capacity do you want to use the online services?
  
  Please select Authorised party. The link to the activation application will appear.
  
  Then please ask your creators to provide you with the necessary authorisations as representative.
• I had opted for my e-mail and a password to login. I no longer have access to my e-mail account. What do I do now?

  If, as a GEMA member, you no longer have access to the email account you use to log in to the GEMA online portal, we will update your login email address for you. This will allow you to continue using your GEMA account and view your details and statements online as usual.

  If you can still log in to the online portal, please log in and go to ‘My Details’, then to ‘User Details’ and ‘Edit email address’, and enter your new email address there.

  If you are unable to log in to the online portal, we will update your login email address for you. Please send us an email for verification to mitgliederservice@gema.de with the subject line ‘Change of login email’ and the following details:

  • Your new email address Your membership number (if applicable)
  • Your date of birth
  • Your address

  We will update your login email as soon as possible and then inform you by email.

  For GEMA customers: If you no longer have access to your email account, you can of course also contact us by email. In this case, please briefly let us know in the email that it concerns a customer account on the online portal.

• What happens if I lose my mobile or if it no longer works?

  No problem whatsoever. In that case, just click on Verify with something else during the login process and select E-mail. Please enter the unique authentication code as a second factor.

  If you have lost your smartphone, you can remove it as a second factor in the Online Portal in the section My details.