Multi-factor authentication (MFA)

MFA requires a second factor in addition to the first, so a stolen password or intercepted code alone isn't enough to get in. Atlas enforces MFA on the server, on every path — including social sign-in — so it can't be bypassed.

Supported second factors

• Authenticator app (TOTP) — a rotating 6-digit code from Google Authenticator, 1Password, Authy, etc.

• Passkey (WebAuthn) — a device biometric or hardware key used as a second factor. The strongest option.

• Backup codes — one-time recovery codes the user saves for when they lose their device.

Enable and require MFA

1. Open Security → Multi-factor.

2. Turn on the factors you want to allow (TOTP, passkey, backup codes).

3. Choose the policy:

   • Optional — users may enroll if they wish.

   • Required — users must enroll a second factor to use the app.

   • Required for privileged roles — e.g. only organization admins.

How a user enrolls TOTP

1. The user opens Security in their account UI and chooses Add authenticator app.

2. Atlas shows a QR code; the user scans it with their authenticator.

3. The user enters the current 6-digit code to confirm.

4. Atlas issues backup codes — the user stores them safely.

Step-up authentication

You can require a fresh factor for sensitive actions (changing email, deleting data) even within an active session. Atlas prompts for the second factor again, then marks the session as recently verified.

Attack resistance

Repeated wrong MFA entries trigger a per-session freeze and account lockout — see Attack protection. Every MFA change is written to the audit log.

Recovery

If a user loses their second factor, they use a backup code, or an admin can reset MFA for them from the dashboard. See Account recovery.

Next

Move from who to what — organize users into teams → Organizations & teams.