> ## Documentation Index > Fetch the complete documentation index at: https://docs.molesignal.com/llms.txt > Use this file to discover all available pages before exploring further. # Multi-factor authentication and passkeys > Verify again on top of the password: passkeys (iCloud Keychain, Google Password Manager, security keys) and authenticator apps, signing in without a password, recovery codes, which sign-ins ask for the second step, and resetting it as an administrator or on the server. Multi-factor authentication asks for one more check on top of the password, so knowing the password alone no longer signs anyone in. An account with either second factor below has it on, and the two can be used together. Each account sets this up under **Account settings → Security & sign-in**, and a workspace can [require it of its members](https://docs.molesignal.com/en-US/identity/sso.md#sign-in-requirements): members who haven't turned it on set it up as they sign in. | Second factor | How it verifies | | - | - | | Passkey | Confirm with a fingerprint, your face, or your device's passcode. There is no code to type, and a phishing site cannot trick it out of you. It can be kept in iCloud Keychain, Google Password Manager, 1Password, or a security key, and it can also sign you in on its own, without the password. | | Authenticator app | Enter a 6-digit code from an app such as Google Authenticator, Microsoft Authenticator, or 1Password. | ## Confirm it's you first Turning on the authenticator and adding a passkey both start by confirming that this is the account's owner. Being signed in isn't enough: otherwise someone holding a session could add their own second factor and lock the owner out. | Account | How to confirm | | - | - | | Already has a second factor | With an existing passkey, the authenticator, or a recovery code. | | Has no second factor yet | Enter the account password. | | Has no password (created by single sign-on) | Nothing to enter within 10 minutes of signing in. After that, sign in again. | ## Add a passkey **1. Open the setting** In the **Passkeys** row of **Account settings → Security & sign-in**, click **Add a passkey**, and confirm it's you as above. **2. Create it** Give it a name if you like, such as "My MacBook", click **Create**, and follow the prompt from the browser or the system. **3. Save the recovery codes** When this is the account's first second factor, multi-factor authentication turns on and ten recovery codes appear, shown only this once. Keep them with **Copy** or **Download**, then click **I’ve saved them**. When the instance can [send email](https://docs.molesignal.com/en-US/configuration.md#alerting-and-email), the account's email gets a notice. A first passkey also ends every sign-in of the account in other browsers and on other computers, while this browser stays signed in; adding more leaves other sign-ins alone. The browser and the system decide where a passkey can be kept, and their prompt offers the choice: | Kept in | Notes | | - | - | | iCloud Keychain | Safari on Apple devices. It works on every device with the same Apple Account. | | Google Password Manager | Chrome and Android. It works on every device with the same Google Account. | | A password manager | 1Password, Bitwarden, and others. | | A security key | YubiKey and other FIDO2 keys. | When a computer has no passkey at hand, the browser can also show a QR code to confirm with a passkey on a phone. In the list, a passkey without a name shows where it is kept; when the browser doesn't report that, it shows only Passkey. ### What the instance needs A passkey is bound to the instance's domain name, which brings these requirements. Without them, **Add a passkey** is greyed out with the reason, and the sign-in page doesn't offer passkeys. | Requirement | Notes | | - | - | | `[http].external_url` is set | See [Configuration](https://docs.molesignal.com/en-US/configuration.md). | | It is a domain name | Browsers don't accept IP addresses. | | It uses HTTPS | Except on `localhost`. | | The console is opened at that address | Opened at another host name, the browser refuses to use passkeys. | After the host name of `external_url` changes, existing passkeys stop working: sign in with the password or a recovery code and add them again. ## Turn on the authenticator **1. Open the setting** In the **Authenticator app** row of **Account settings → Security & sign-in**, click **Turn on**, and confirm it's you as above. **2. Add it to the authenticator app** Scan the QR code with the authenticator app, or type in the key shown under it. The app lists the entry as MoleSignal; with `[http].external_url` set, the name carries its host name, which tells several instances apart. **3. Enter the first code** Enter the 6-digit code the app shows and click **Turn on**. It turns on only once the code matches. **4. Save the recovery codes** When this is the account's first second factor, ten recovery codes appear, shown only this once. Keep them with **Copy** or **Download**, then click **I’ve saved them**. When the account had no second factor before, turning it on ends every sign-in of the account in other browsers and on other computers, this browser stays signed in, and the account's email gets a notice. ## Sign in ### With a passkey, without a password On the sign-in page, click **Continue with a passkey**, or click **Sign in with email**, then the email field, and pick the passkey from the browser's suggestions. A passkey already asks for a fingerprint, your face, or your device's passcode, so it counts as multi-factor authentication and there is no second step. ### Too many wrong passwords After too many wrong passwords, the sign-in page says how long to wait. A passkey or a password reset gets around the wait: a passkey is neither counted nor limited, so the account's owner can still get in while someone else is guessing its password, and a successful reset unlocks the account at once. See [Sign-in limits](https://docs.molesignal.com/en-US/settings/platform.md#sign-in-limits) for the numbers. ### The second step after the password After the password, the sign-in page asks to **Verify it’s you**, with the second factors the account has: | Method | How | | - | - | | Passkey | Click **Verify with a passkey** and confirm in the prompt from the browser or the system. | | Authenticator app | Enter the 6-digit code, which is sent as soon as all six digits are in. A code works while the phone's clock is within 30 seconds of the server's, and each code works once. | | Recovery code | Enter a recovery code that has not been used. Each one works once; once it is used, the sign-in page says how many are left and the account's email gets a notice. | | Case | Result | | - | - | | Five wrong tries in one sign-in | That sign-in ends; enter the password again. | | Ten wrong codes within an hour | Codes and recovery codes are locked for an hour, and the account's email gets a notice. Passkeys are unaffected and can still sign you in without the password. | | The second step is not finished within five minutes of the password | That sign-in expires; enter the password again. | ## Which sign-ins ask for the second step | Sign-in | Second step | | - | - | | Account password | Yes. | | A passkey without a password | No: the passkey is multi-factor authentication by itself. | | LDAP | Yes: LDAP only checks the password in the directory. | | OIDC, OAuth 2.0, and SAML single sign-on | No: the identity provider is responsible for multi-factor authentication. | | A first single sign-on that links an existing account | Yes: after confirming the link, finish the second step to make it. See [Link an existing account](https://docs.molesignal.com/en-US/identity/sso.md#link-an-existing-account). | | Account login from a database client (Flight SQL) | Connecting with the account password is refused; use an [API token](https://docs.molesignal.com/en-US/identity/tokens.md) that starts with `ms_`. See [Database clients](https://docs.molesignal.com/en-US/query/database-clients.md#authentication). | | API tokens | Unaffected. | ## Manage recovery codes If you lose your authenticator and passkeys, each recovery code signs you in once. The **Recovery codes** row of **Security & sign-in** shows how many are left. **Make new codes** asks for a confirmation and gives ten new recovery codes; the old ones stop working. ## Change your second factors Apart from renaming, each of these asks for a confirmation on the spot with a passkey, a code, or a recovery code. | Action | How | | - | - | | Rename a passkey | Click **Rename** on its row. | | Delete a passkey | Click **Delete**. A copy kept in iCloud Keychain or a password manager has to be deleted there; browsers that support it tell the system to clean up the next time it is tried for signing in. | | Replace the authenticator | Click **Replace authenticator**, confirm, then scan the new QR code and enter a code from it. The recovery codes stay the same. | | Turn off the authenticator | Click **Turn off**. | Removing the account's last second factor turns multi-factor authentication off: the recovery codes stop working and the account's email gets a notice. While a workspace of the account [requires multi-factor authentication](https://docs.molesignal.com/en-US/identity/sso.md#sign-in-requirements), that isn't possible: **Turn off** and **Delete** are greyed out and say which workspace requires it. ## Reset by an administrator When a member has lost every second factor and used up the recovery codes, an administrator opens the member's actions under **Identity & Access → Users** and clicks **Reset multi-factor authentication**. This requires `org.members.mfa_reset`. The member's authenticator, passkeys, and recovery codes stop working, every device is signed out, and the account's email gets a notice; the member then signs in with the password and sets it up again; where a workspace requires it, as part of signing in. | Member | Who can reset | | - | - | | Belongs to this organization only | An administrator of this organization. | | Also belongs to other organizations | Only the platform administrator: a reset affects every organization of the member. | | The root user | Only on the server, with an [offline reset](#offline-reset). | The **MFA** column of the **Users** list shows whether each member has it on. ## Offline reset When the root user has lost every second factor, or no administrator can sign in, run on the server: ```bash theme={null} molesignal --config /etc/molesignal/config.toml reset-mfa --email root@example.com ``` The command turns multi-factor authentication off for the account, ends all of its sign-ins, and exits without starting the service. ## Sign-ins that end These actions end the account's sign-ins in other browsers and on other computers, from the next request made there: * adding a first second factor, which turns multi-factor authentication on; * replacing or turning off the authenticator, or deleting a passkey; * an administrator's reset; * **Sign out all other devices** under **Active sessions**; * resetting the password from the emailed link, which ends every sign-in of the account. After a workspace turns on a [sign-in requirement](https://docs.molesignal.com/en-US/identity/sso.md#sign-in-requirements), sessions that don't meet it end within 15 minutes. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.