Skip to main content
Two-factor authentication adds a six-digit, time-based authenticator code to sign-in. Users enroll their own authenticators; an administrator can require enrollment for a company. The requirement is company-scoped, while the authenticator is user-scoped.

​
Turn it on for yourself

Alforse emails you a receipt the moment it’s on; if one arrives that you didn’t cause, remove the factor and tell an admin. To remove it yourself, press the trash icon next to the factor and enter a current code. Once verified, every sign-in asks for a code — magic link, Google, Outlook, and passkey alike. Single sign-on is the one exception: an SSO session arrives with your identity provider’s MFA already enforced, so Alforse skips its own code screen.

​
Require it for everyone

Open Settings → System → Security and turn on Two-Factor Authentication Enforcement. It takes effect on each person’s next page load, and every active employee is emailed the announcement. Anyone without an authenticator then sees a full-screen “Set up authenticator app” prompt — they complete the same QR-and-code flow right there, or sign out; there is no way past it. Once enforcement is on, Users → Accounts shows a Two-Factor column reading “Enabled” or “Not set up” per person. The column only renders while the company requires two-factor.

​
When someone loses their phone

There are no printed backup codes — recovery is an admin action, which keeps it auditable. An admin with permission to update users opens Users → Accounts and chooses “Reset Two-Factor Auth” from the person’s row menu. Their next sign-in is an ordinary magic link, and they enroll a fresh device.

​
What it doesn’t cover

Machine access is never challenged: API keys and integrations keep working, and shop-floor PIN operators are never prompted — they pin in at a shared terminal, so two-factor applies to whoever signed the terminal in. To restrict what an authenticated person can reach, that’s permissions.