MFA For User Accounts

Multi-Factor Authentication adds a second verification step to signing in: after entering an email and password, the user also has to enter a one-time code sent by text message or email. This protects admin accounts even if a password is compromised.

Where to find MFA settings

Go to Settings > Users, then open (or create) a user record. MFA is configured per user, on that user's account.

Any authenticated user can set up MFA on their own account, regardless of access level.

Turning on MFA for a user

1. Open the user's record in Settings > Users.
2. Check Enable Multi-Factor Authentication (MFA).

3. Choose a Verification method:

Text message (SMS): sent to the phone number on the user’s record

Email: sent to the email address on the user’s record

4. Click Send verification code.

5. Enter the 6-digit code you received and click Confirm.

6. Once confirmed, the method shows a Verified badge, and MFA is active for that user.

Select Save at the top when done

If you don't receive the code, use Resend code (limited to once every 60 seconds to prevent abuse).

Changing the verification Method or contact info

If you switch the verification channel (SMS ↔ Email), or change the phone number or email address that MFA sends to, the Verified badge disappears and you'll need to send and confirm a new code for the updated method before it takes effect.

Signing in with MFA

Once MFA is enabled on a user's account, signing in works like this:

1. Enter your email and password as usual and click Sign In.
2. A verification code is automatically sent to your configured phone number or email.
3. Enter the 6-digit code on the screen and click Verify.
4. If you don't receive it, click Resend code (also limited to once every 60 seconds).

A few things to know about this step:

• The sign-in session waits 5 minutes for the code to be entered. If it takes longer, you'll need to start the sign-in process over from the beginning.
• Entering an incorrect code repeatedly will temporarily block further attempts as a brute-force protection; wait a few minutes and try again.

Turning off MFA

Open the user's record in Settings > Users and uncheck Enable Multi-Factor Authentication (MFA). This removes the code-verification step from that user's sign-in going forward.