Getting started with BERIFFA Keystone

BERIFFA Keystone is a T-code platform for Windows: you work in one fast, keyboard-first program on your PC — type a short code and the right screen opens — and your company adds its own T-codes, on its own Keystone server hosted by BERIFFA in the EU. This guide takes you from the download to your first T-code.

What you need

• A PC with Windows 10 or Windows 11, 64-bit. You do not need administrator rights.
• The BERIFFA Service Token of your company's server, from your administrator. It is a long text that starts with BST1.
• Your user name and initial password, from your administrator. The password usually comes through a different channel, for example by phone.
• An authenticator app on your phone, for example Microsoft Authenticator or Google Authenticator, if you sign in with a BERIFFA Keystone account.

1. Install BERIFFA Keystone

1. Download BERIFFA-Keystone-Setup.exe from the BERIFFA Keystone download page on beriffa.com. The download needs a beriffa.com account with a BERIFFA Keystone service; otherwise your administrator gives you the installer. It is the same program for every company.
2. Run the downloaded file. Installation takes a few seconds.
3. If Windows shows "Windows protected your PC", click More info, then Run anyway. The installer is not code-signed yet. Only do this for the installer from the BERIFFA Keystone download page or from your administrator.
4. Start BERIFFA Keystone from the Start menu or the desktop. The first window is the system list.

BERIFFA Keystone runs once per Windows user: starting it again while it runs brings its system list to the front.

2. The system list

The system list, in the window BERIFFA Keystone Logon, shows the systems you can log on to. A system is one BERIFFA Keystone server, for example DEV (development), QAS (test) or PRD (production).

• Groups (left) filter the list; All systems shows everything.
• Systems (right): select a line and press Enter, double-click it, or click Log On.
• Add Connection adds your company's server with the BERIFFA Service Token. This is the normal way.
• New Entry adds a system by hand. Use it only when your administrator gives you the details.
• Change Entry and Delete Entry work only for entries you added yourself.

If an entry is not verified, BERIFFA Keystone asks you to confirm before it sends your sign-in to that server. Continue only if you trust the server. Entries added with Add Connection are verified by their token, so you are not asked.

3. Add your connection

1. Click Add Connection.
2. Paste the BERIFFA Service Token. Line breaks from an e-mail do not matter. Below the field you see which system the token is for.
3. Hostname or IP address is filled in from the token. Change it only if your administrator tells you to, and leave Port empty unless you were given one.
4. Click Check Connection. BERIFFA Keystone checks the token and asks the server who it is. If the server is the one named in the token, the system is added to your list, marked Verified.

If it fails, the window says why. Copy the token again if it was changed or cut off; ask your administrator for a new one if it has expired or does not name its server; update BERIFFA Keystone if it says that it does not know the token's key. A token is valid for at most two years; you then paste the new one with Add Connection again.

4. Log on for the first time

1. Select your system and click Log On. BERIFFA Keystone checks the server and your program version, and shows any system messages.
2. Click Sign in with BERIFFA Keystone account. Your web browser opens the system's logon page; BERIFFA Keystone itself never sees your password.
3. Enter your user name and initial password.
4. Choose your own new password: 12 to 128 characters, not containing your user name, not a common password and not one short pattern repeated. There are no other rules.
5. Set up your authenticator app: add an account in the app and type in the secret key shown on the page, or open the setup link. Then enter the 6-digit code the app shows.
6. Write down the 10 recovery codes and keep them safe. They are shown only once, and each one can replace an authenticator code once, for example if you lose your phone.
7. When the browser says that you can close the window, go back to BERIFFA Keystone. Your first session window opens with the BERIFFA Main Menu.

From then on you log on with your user name, your password and the 6-digit code from the app.

Signing in with Microsoft

If Microsoft sign-in is enabled for your company, the Log On window shows Sign in with Microsoft. Click it and sign in with your company Microsoft account in the browser.

Good to know

• After 5 wrong passwords or codes your user is blocked for 15 minutes. For your security the logon page always says only "Logon failed". Wait 15 minutes or ask your administrator.
• You stay signed in while you work. After 8 hours without using the program, or 24 hours after you logged on, you log on again.
• After you log off, the next logon to that system asks for your password and code again, so on a shared PC the next person cannot use your logon.
• Change your password with Tools ▸ Change Password. If you sign in with Microsoft, change it in your Microsoft account instead.
• Forgot your password? Your administrator sets a new initial password. Lost your phone? Log on with a recovery code, or ask your administrator to reset your authenticator app.
• "No ERP user exists": signing in proves who you are, but you also need a user on that system. Ask your administrator.
• After you sign in, the system may show licence notices. Click Continue; your administrator takes care of the licence and you can keep working.

Next, read Working with T-codes to find your way around the screens.