# Two-factor authentication (2FA)

Require admins, or all users, to confirm their identity with a second verification method when they log in to RandomCoffee.

import { Steps } from '@prosefly/astro-components';
import Callout from '@components/Callout.astro';
import TwoFactorPanel from '@components/app-screens/screens/TwoFactorPanel.astro';
import TwoFactorSetupPage from '@components/app-screens/screens/TwoFactorSetupPage.astro';
import AuthenticatorAppModal from '@components/app-screens/screens/AuthenticatorAppModal.astro';

Two-factor authentication (2FA) is a security measure that requires two forms of verification to access an account:

1. the user's password;
2. a code sent by SMS or generated by an authenticator app.

As an admin, you can make 2FA required for the admins of your workspace, or for all its users.

<Callout type="note">
  Two-factor authentication is available on the Enterprise plan.
</Callout>

## Require 2FA

<Steps>

1. **Open the 2FA settings.**

   Go to "Settings" > "Configuration" and click the "Two-factor authentication (2FA)" card.

2. **Choose who must use 2FA.**

   Select one of the options:

   - "Require for Administrators only"
   - "Require for all members"
   - "Don’t require"

   <TwoFactorPanel alt="The &quot;Two-factor authentication (2FA)&quot; panel, with the options &quot;Require for Administrators only&quot; (selected), &quot;Require for all members&quot; and &quot;Don't require&quot;" />

3. **Confirm.**

   In the "Require 2FA on login?" window, click "Confirm".

</Steps>

The users concerned are asked to set up 2FA the next time they open RandomCoffee. If the option applies to you, you are asked right away.

## What users see

The next time they open RandomCoffee, the users concerned see a page that asks them to set up two-factor authentication. They choose a second verification method: "Use an authenticator app" or "Use SMS", and click "Enable".

<TwoFactorSetupPage alt="The two-factor setup page, with the &quot;Use an authenticator app&quot; and &quot;Use SMS&quot; options and their &quot;Enable&quot; buttons" />

- **With an authenticator app** (for example, Google Authenticator): they scan the QR code shown on screen, or enter the code manually, in their app. They save the backup code somewhere safe: it gives access to their account if they lose their device. Then they enter the six-digit code from the app and click "Verify".

  <AuthenticatorAppModal alt="The &quot;Configure authentication app&quot; window, with the four setup steps, the setup code, a sample QR code, the backup code, the six-digit code boxes and the &quot;Verify&quot; button" />

- **With SMS**: they enter their country code and phone number, then the six-digit code they receive by SMS.

From then on, each time they log in, they enter their password, then confirm with their chosen method.

## Stop requiring 2FA

In the same card, select "Don’t require", then confirm. Users can then log in without a second verification method.