MFA adds a time-based one-time password (TOTP) step after email verification.

​
For end users

1

Enter email and click Check MFA

The platform calls the backend to see if MFA is enabled for your account.
2

If MFA is enabled

The password field is replaced with an OTP field. Open your authenticator app (Google Authenticator, Authy, etc.).
3

Enter the 6-digit code

Codes rotate every 30 seconds. Enter the current code and click Login.

​
For administrators

MFA is configured per user in the admin user form:
  • Enable isMfaEnabled on the user record
  • A secret (mfaSecret) is generated server-side
  • Share the QR / secret with the user for authenticator enrollment
Admins can view MFA status in the user list; QR preview code exists but may be commented out in the UI.

​
API flow (reference)

​
Tips

  • Sync phone/computer clock if codes are always rejected.
  • After MFA is enabled, password-only login will not work — always use OTP.
  • Contact an admin to disable MFA if you lose access to the authenticator.