# Two-factor authentication

> Protect your console sign-in with a code from an authenticator app: turn it on, sign in with it, keep recovery codes, and what to do if you lose your device.
> Source: https://mdrn.io/docs/two-factor/

When this page is done, signing in to the MDRN console asks for a code from your authenticator app as well as your usual sign-in, and you have recovery codes saved for the day you lose your phone. Everything here is under **Account** in the console. It protects your MDRN account; to give the users of your own app the same, see [Auth](/docs/auth/).

| What | Value |
| --- | --- |
| Codes | 6 digits from an authenticator app, a new one every 30 seconds; each is accepted once |
| Recovery codes | 10, each used once, shown only when they are made |
| Wrong codes | 5 in one sign-in, then the sign-in starts over; 10 in 15 minutes, then every code is refused until the 15 minutes pass (`429 SECOND_FACTOR_LOCKED`) |
| Changes accepted | Within 5 minutes of signing in; later, `403 FRESH_SIGN_IN_REQUIRED` |
| Turning it off, replacing the app | Also a current code or a recovery code; a wrong one is `400 INVALID_CODE` |

## Turn it on

1. Open **Account** and choose **Turn on** under two-factor authentication.
2. In your authenticator app, scan the QR code. If you cannot scan it, type the key shown under it instead.
3. Enter the 6-digit code the app shows, to confirm the app is set up.
4. Save the 10 recovery codes MDRN shows: download them, print them or put them in your password manager. They are shown once; MDRN keeps only a one-way hash of each.

MDRN emails you when it is turned on, turned off or moved to a new app. You set it up once: if you sign in with more than one method (an email code, Google, GitHub), every one of them asks for the code from the same app, and the same recovery codes work for each. A sign-in method you link later asks for it too, from the sign-in that links it.

## Sign in with it

Sign in as usual. MDRN then asks for the current code from your authenticator app. If you do not have the app with you, enter one of your recovery codes instead; that code then stops working, and MDRN emails you how many are left. Too many wrong codes stop the sign-in for a while (see the table above); wait, then try again.

## Get new recovery codes

Under **Account**, choose **New recovery codes**. You get 10 new codes, shown once, and every earlier code stops working. Do this when you have used most of them, or think someone has seen them.

## Replace your authenticator app

For a new phone or another app: under **Account**, choose **Replace authenticator**, enter a code from the app you use now (or a recovery code, if you no longer have it), then scan the new QR code and enter the code the new app shows. Until you confirm, your current app keeps working; once you do, only the new one does. Your recovery codes stay the same. MDRN emails you that it was replaced.

## Turn it off

Under **Account**, choose **Turn off** and enter a code from your authenticator app or a recovery code. You can always turn it off. If a workspace you belong to requires two-factor authentication, you can still sign in and read there, but every change you make in it is refused (`403 SECOND_FACTOR_REQUIRED`) until you turn it on again; **Account** names the workspace before you confirm.

## Changes need a fresh sign-in

Turning it on or off, replacing the app and making new recovery codes need a sign-in in the last 5 minutes. Turning it off and replacing the app also need a current code or a recovery code, so that someone who got hold of a signed-in browser cannot remove it. Later than that, the console answers `403 FRESH_SIGN_IN_REQUIRED`, "For your security, sign in again to change two-factor authentication.", and offers **Sign in again**, which brings you back to **Account**.

## If you lose your device

Sign in with a recovery code, then choose **Replace authenticator** under **Account** and prove it with another recovery code to set up your new device. Make new recovery codes afterwards if you have used most of them.

If you have no recovery code left, write to [support@mdrn.io](mailto:support@mdrn.io) from the address you sign in with. Support checks that it is you before anything is reset: MDRN replies to that address with questions only you can answer, and never resets it on a call or a chat, or for a message from another address. Once it is reset, every console session of yours ends and MDRN emails you a notice. Sign in again and turn it on again; where a workspace requires it, you must before you can change anything there.

## When a workspace requires it

An Admin can require two-factor authentication for every member of a workspace; see [Teams](/docs/teams/#require-two-factor-authentication). The codes on this page are listed under [Two-factor authentication](/docs/errors/#two-factor-authentication) on the Errors page.