Add a second factor to user authentication
Protecting customer sign-ins
Kinde · Const
MFA
MFA requires users to prove their identity with at least two authentication factors. Kinde lets you make MFA mandatory or optional and supports email, SMS, and authenticator-app verification.
How it works
MFA requires users to authenticate with at least two factors. Kinde can make it mandatory or optional and supports email, SMS, and authenticator-app verification as secondary methods.
Syntax
MFA: enabled | optional | disabledKey points
- MFA combines the primary sign-in method with at least one additional authentication method.
- The environment policy can require MFA for everyone or allow users to opt in.
- Supported secondary factors include email, SMS, and authenticator apps.
- With mandatory MFA, setup is requested at initial registration or the next login.
- Optional MFA presents setup as a choice during initial registration or the next login.
- Recovery codes provide an alternative when the user cannot access the normal MFA device.
Example: MFA configuration flag
const mfaEnabled = true;
console.log(`MFA enabled: ${mfaEnabled}`);Represents whether multi-factor authentication is enabled for the environment.
When to use it
Apply MFA settings per organization
Supporting different tenant policies
Use recovery codes when a device is unavailable
Recovering account access
Interview questions
QWhat does MFA provide in Kinde?
MFA adds a second authentication factor after the primary sign-in method. Kinde supports email codes, SMS codes, and authenticator apps as secondary factors.
Follow-up: How can MFA policy vary across tenants? Kinde can configure MFA per organization, allowing organization-specific methods and recovery-code settings.
QHow do mandatory and optional MFA differ?
The environment setting can make MFA mandatory, optional, or disabled. Mandatory MFA prompts users to set it up when they first sign up or next sign in, while optional MFA lets them choose whether to configure it.
Follow-up: What happens if an organization needs a different recovery-code policy? Its organization-level setting overrides the environment-level recovery-code setting.
QWhy are recovery codes useful?
Users can receive recovery codes during MFA setup and use one if they lose access to their device or authenticator app. Administrators can control whether recovery codes are enabled.
Follow-up: Which MFA methods can be offered together? Kinde allows more than one additional method, such as email, SMS, and an authenticator app.
Related
multi-factor authenticationrecovery codesSMS verificationAuthenticator appMFA per organization