Access Control · Multi-Factor Authentication

Pick a method to set up. The factor stays disabled until verification or registration completes for the signed-in user {{ username }}.

{{ anyMethodActive ? 'lock' : 'lock_open' }} {{ anyMethodActive ? 'MFA Active' : 'MFA Off' }}
@if (!selectedMethod) {
add_task

Select an authentication method

Choose how you want to confirm sign-in. Only one method may be active at a time.

@if (activeMethod) {
info {{ activeMethod === 'sms' ? 'SMS OTP' : activeMethod === 'email' ? 'Email OTP' : activeMethod === 'totp' ? 'Authenticator App' : 'Hardware Token' }} is currently active. Disable it first to switch to a different method.
}
@if (pickedMethod) { check_circle {{ methodLabel(pickedMethod) }} selected. Continue to set it up. } @else { radio_button_unchecked Pick a method above to continue. }
} @if (selectedMethod) {
@if (selectedMethod === 'sms') {
smartphone

SMS OTP

Type · SMS
{{ sms.verified ? 'check_circle' : 'cancel' }} {{ sms.verified ? 'Verified' : 'Not Verified' }}

Verify a 10-digit Indian mobile number with a one-time passcode.

  1. 1
    Enter mobile 10-digit Indian number
  2. 2
    Verify OTP 6-digit code
  3. 3
    Activated Ready to use
@if (sms.busy) { } @if (!sms.destinationConfirmed) {
Step 1 · Mobile number

We'll send a 6-digit code to this number. Standard SMS rates may apply.

@if (sms.destination && profileLoaded) {
person_pin Prefilled from your profile. Update your profile to change it.
}
Mobile number +91  lock @if (sms.errorMsg) { {{ sms.errorMsg }} }
} @else if (!sms.verified) {
Step 2 · Enter OTP
smartphone Code sent to +91 {{ sms.destination }}
6-digit OTP @if (sms.resendIn > 0) { Resend in {{ sms.resendIn }}s } @else { Resend OTP }
@if (sms.errorMsg) {
error_outline {{ sms.errorMsg }}
}
} @else {
{{ sms.mfaEnabled ? 'check_circle' : 'pause_circle' }}
{{ sms.mfaEnabled ? 'SMS OTP active' : 'SMS OTP verified · 2FA disabled' }} Number on file: +91 {{ sms.destination }} @if (sms.mfaEnabled) { — OTP will be sent on every sign-in. } @else { — re-enable any time without re-verifying. }
@if (sms.mfaEnabled) { } @else { }
}
} @if (selectedMethod === 'email') {
mail

Email OTP

Type · EMAIL
{{ email.verified ? 'check_circle' : 'cancel' }} {{ email.verified ? 'Verified' : 'Not Verified' }}

Verify your email address with a one-time passcode.

  1. 1
    Enter email Valid email address
  2. 2
    Verify OTP 6-digit code
  3. 3
    Activated Ready to use
@if (email.busy) { } @if (!email.destinationConfirmed) {
Step 1 · Email address

We'll send a 6-digit code to this address. Check your spam folder if not received.

@if (email.destination && profileLoaded) {
person_pin Prefilled from your profile. Update your profile to change it.
}
Email address alternate_email lock @if (email.errorMsg) { {{ email.errorMsg }} }
} @else if (!email.verified) {
Step 2 · Enter OTP
mail Code sent to {{ email.destination }}
6-digit OTP @if (email.resendIn > 0) { Resend in {{ email.resendIn }}s } @else { Resend OTP }
@if (email.errorMsg) {
error_outline {{ email.errorMsg }}
}
} @else {
{{ email.mfaEnabled ? 'check_circle' : 'pause_circle' }}
{{ email.mfaEnabled ? 'Email OTP active' : 'Email OTP verified · 2FA disabled' }} Address on file: {{ email.destination }} @if (email.mfaEnabled) { — OTP will be sent on every sign-in. } @else { — re-enable any time without re-verifying. }
@if (email.mfaEnabled) { } @else { }
}
} @if (selectedMethod === 'totp') {
qr_code_2

Authenticator App

Type · TOTP
{{ totp.verified ? 'check_circle' : 'cancel' }} {{ totp.verified ? 'Registered' : 'Not Registered' }}

Generate a key, scan it in your authenticator app, then enter the 6-digit code to register this device.

@if (!totp.secret && !totp.verified) {
qr_code_scanner
No authenticator linked yet

Generate a setup key, scan it in your TOTP app, then verify the 6-digit code shown there.

} @else if (totp.secret && !totp.verified) {
@for (row of totpQrCells; track $index) {
@for (cell of row; track $index) { }
}

Scan in your authenticator app

1
Open Google Authenticator (or any TOTP app) and tap “Add account”.
2
Scan the code on the left, or enter the secret manually.
{{ totp.secret }}
3
Enter the 6-digit code shown by your app to verify and register this device.
Authenticator code @if (totp.errorMsg) { {{ totp.errorMsg }} }
} @else {
check_circle
Authenticator app registered Sign-in will require a 6-digit TOTP code from your app.
}
} @if (selectedMethod === 'hardware') {
memory

Hardware Token

Type · DSC
{{ methodStatus('hardware').ok ? 'check_circle' : 'cancel' }} {{ methodStatus('hardware').label }}

Choose a device kind, then connect & register it.

@if (!selectedHwKind) {
@for (item of hardware; track item.kind) {
{{ item.icon }}
{{ item.title }} {{ item.registered ? 'check_circle' : 'radio_button_unchecked' }} {{ item.registered ? 'Registered' : 'Not Registered' }}

{{ item.description }}

@if (item.registered) {
tag {{ item.serial }} schedule {{ item.registeredAt }}
}
}
} @else if (currentHwItem) {
{{ currentHwItem.icon }} @if (currentHwItem.busy) { } @if (currentHwItem.registered) { check }

{{ currentHwItem.title }} {{ currentHwItem.registered ? 'check_circle' : 'cancel' }} {{ currentHwItem.registered ? 'Registered' : currentHwItem.busy ? 'Detecting…' : 'Not Registered' }}

{{ currentHwItem.description }}

  1. {{ currentHwItem.busy || currentHwItem.registered ? 'check_circle' : 'circle' }} Connect / insert the device
  2. {{ currentHwItem.registered ? 'check_circle' : currentHwItem.busy ? 'autorenew' : 'circle' }} Detect & read serial number
  3. {{ currentHwItem.registered ? 'check_circle' : 'circle' }} Bind device to {{ username }}
@if (currentHwItem.registered) {
Serial {{ currentHwItem.serial }}
Registered on {{ currentHwItem.registeredAt }}
}
@if (currentHwItem.kind === 'digital-signature') { @if (!currentHwItem.registered) { } @else if (currentHwItem.mfaEnabled) { } @else { } } @else { @if (!currentHwItem.registered) { } @else { } }
}
}
}