Skip to main content

Keeping your portal sign-in secure

This page is for merchant users of the Peak Merchant Gateway portal and agent partners who use Peak Gateway support sign-in. You sign in with your own Google account and confirm with your enrolled authenticator app (or an enrolled SMS factor for agents). After a successful second factor, that browser remembers the verification for 7 days. There is no separate Peak Gateway password.

Remembered browsers

Every new sign-in still requires Google. A remembered browser skips only the second-factor prompt, until exactly seven days after the original verification; signing in again does not extend that time. A different browser still needs a second factor. Browser trust is protected by an HttpOnly, Secure cookie and validated by Gateway, not a local-storage setting.

Changing or resetting your Gateway factors, disabling your account, or revoking your Gateway sessions invalidates browser trust. In your two-factor settings, Sign out everywhere and forget all browsers revokes sessions and all remembered browsers. Use it before leaving a shared device or if you suspect compromise. Changing your upstream Google password does not itself clear Gateway browser trust; fresh Google sign-in is nevertheless required on every Gateway re-login.

The 15-minute inactivity sign-out below is unchanged. Remembering a browser does not keep a portal session signed in.

Protect your Google account and authenticator

  • Sign in only with your own Google account and your own authenticator app. Never share your account with anyone, including co-workers.
  • Never share your Google password or authenticator codes. Peak Gateway staff will never ask for them.
  • Use a strong Google password that you do not reuse on any other site.
  • Turn on Google 2-Step Verification for your Google account.

If you suspect a compromise

If you think your Google account, Google password or authenticator device has been compromised:

  1. Change your Google password immediately (Google Account → Security).
  2. Contact Peak Gateway support so we can reset your authenticator app and review recent access to your account.

Lost or replaced authenticator

If you lose the phone or app that holds your authenticator, contact Peak Gateway support. After we confirm your identity, we reset the authenticator so you can enroll a new one at your next sign-in.

Lockout and automatic sign-out

  • 10 incorrect authenticator codes lock your account for 30 minutes. After that, sign in again. If you did not enter those codes, contact Peak Gateway support.
  • The portals sign you out after 15 minutes of inactivity. Sign in again to continue. A new sign-in or support impersonation starts its own inactivity window; an older sign-in in the same browser does not end a newly opened support session. Reloading an existing session does not bypass idle sign-out.