Two-factor authentication

Turn it on for yourself

1. Open Profile → Security → Two-factor authentication and choose Turn on.
2. Confirm your password, then scan the QR code with Google Authenticator, 1Password, Authy or any TOTP app (or enter the key manually).
3. Enter the 6-digit code from the app.
4. Save the ten backup codes. Each one signs you in once if you lose your device. They are shown only once.

At every sign-in you will enter your password, then a code. Tick Trust this browser for 30 days to skip the code on that browser.

Require it for your organization

Organization owners and members with the Manage Security Settings permission can open Security in the sidebar and switch on Require MFA for all members. Members who have not set up an authenticator are taken to the setup page the next time they open BestDefense and cannot use the platform until they finish. The Member enrolment table shows who has enrolled and when.

Members who sign in with your identity provider (SSO) are exempt: your provider enforces MFA before BestDefense is reached.

If you lose your device

• Use a backup code at the sign-in prompt (Use a backup code).
• Ask an organization admin to Reset MFA for you from Security → Member enrolment. You will receive an email and can set it up again.
• With no codes and no admin, contact support; we verify your identity before resetting.

API access

API keys and tokens are not subject to two-factor authentication. Treat them as secrets.

Password sign-in through POST /auth is browser-only once an account has MFA: it returns 401 two_factor_required for enrolled users, and the second-factor step (/2fa/check) can only be completed in the browser, because it requires the sign-in page’s CSRF token. For automation, use an API key rather than a password sign-in.