MFA and passkeys

Multi-factor authentication (MFA) adds a second step to sign-in. In Verdictan, the second step is an authenticator app or a passkey. Setup also gives you ten one-time backup codes, so that you can still get in if you lose the device.

An account has one active MFA method at a time. To change it, see Switch methods.

Select a method

Method	What you need
Authenticator app	An app that shows a new six-digit code every few seconds (TOTP)
Passkey	A device authenticator or hardware security key, used through the browser prompt

Sign in with the account you want to protect, and have a password manager or safe offline place ready for the backup codes. For an authenticator app, turn on automatic time on its device. For a passkey, use a browser and authenticator with WebAuthn support.

Set up an authenticator app

1. Open Settings → Profile and find Two-factor authentication.
2. Select Set up next to Authenticator app.
3. Scan the QR code with your authenticator app.
4. Under Connect and verify, enter the six-digit code from the app.
5. Save the backup codes.
6. Sign out, sign in again, and complete the MFA challenge.

Your profile now shows MFA as enabled.

The QR code contains the secret that generates your codes. Do not share it or capture it in a screenshot that others can see.

Set up a passkey

1. Open Settings → Profile and find Two-factor authentication.
2. Select Set up next to Passkey.
3. Complete the browser prompt with your device or security key.
4. Save the backup codes.
5. Sign out and sign in again with the passkey.

Keep the backup codes

Each code works for one sign-in. Keep the codes somewhere you can reach without your primary device, never in tickets, source control, or chat.

To test recovery, sign in with one code and mark it as used. If someone else may have seen the codes, or you have used them all, set up MFA again to get new ones.

Restore access

If you cannot use your authenticator, sign in with an unused backup code and replace the lost method from that session.

Without an authenticator or a backup code, follow your organization's identity recovery process. Never give an authenticator code, QR secret, passkey, or backup code to support staff.

If you suspect unauthorized access, also review your sessions, tokens, OAuth clients, and recent activity.

Switch methods

1. Make sure you can sign in and have a recovery method.
2. In Settings → Profile, select Disable MFA.
3. In the same session, set up the new method.
4. Save its new backup codes.
5. Sign out and sign in with the new method.

The account has no MFA between steps 2 and 3, so finish right away.

Set the organization MFA policy

Administrators with org:settings set the requirement in Settings → Organization → MFA Policy:

Policy	Effect
Optional - users choose to enable MFA	Members enroll when they choose.
Required for Admins & Owners	Owners and administrators must enroll before they continue.
Required for all members	Every member must enroll after a grace period.

The grace period is 72 hours from the moment MFA becomes required for a member. Check the value that the Console shows before you apply the policy.

Before you change the policy, check enrollment in IAM → Members, and send members the enrollment and recovery steps. Then save the policy, test sign-in with a member who must enroll, and find the change in Trail.

An enrollment label is not a sign-in test. Check the challenge and the recovery path on the devices your team uses.

Troubleshooting

Problem	What to check
An app code fails	Use a fresh code for this Verdictan account, and turn on automatic time on the device. Then start setup again.
Setup says a method is active	The account already has one. Use Switch methods.
No passkey prompt	Browser and authenticator support, and whether the browser blocked the prompt
A backup code fails	That the code is unused and from the current MFA setup. Otherwise use another recovery method.
An owner is stuck after a policy change	The account must complete enrollment.

Next steps

• Members and Teams: check enrollment and member status.
• SSO and SCIM: sign in with your company identity provider.