Skip to main content
Multi-Factor Authentication (MFA) adds a layer of security to your app. MFA is structured as enrollment (users register a second factor) and enforcement (when it is required—at login and/or for specific actions like transactions).
Before implementing MFA in your application, configure MFA settings in the dashboard. See End-User MFA for enrollment and enforcement (session-based and/or action-based), configuration options, and dashboard setup.
Users can use passkeys or TOTP devices for MFA - each guide covers both.

MFA Enrollment

Learn how to implement MFA enrollment (registering a TOTP device or Passkey).

Action-based enforcement

Learn how to implement action-based enforcement (MFA for sensitive actions).

Step-up authentication

Step-up auth (the broader category) requires re-verification before sensitive actions; MFA is one way to satisfy it. This guide uses elevated access tokens.