How do I set up MFA for my users?

Forte has multi-factor authentication built in for your project's end users — you don't add a separate MFA vendor. You turn it on per project and choose how strict it is.

Turn it on

MFA is configured on the project, next to your other authentication settings, in the console or via the CLI. Pick an enforcement mode:

• Disabled — MFA is off (the default).
• Optional — users who have a second factor are challenged for it; users who don't sign in normally.
• Required — every user must pass a second factor, and a user who has none is forced to enroll one before they get a session.

Then choose which second factors to allow: authenticator app (TOTP), passkeys and security keys (WebAuthn), email one-time passcode, and SMS one-time passcode. After a user activates TOTP or WebAuthn, they can generate backup codes as a recovery supplement. Backup codes cannot be the user's first enrolled factor.

Forte refuses settings with no reliable completion path. Required MFA can use contact OTP alone only when passwordless OTP sign-in is disabled and password or Google remains available as the first factor. If passwordless email or SMS sign-in remains enabled, add an authenticator-app or WebAuthn factor.

Handle it in your app

Every first-factor login call returns an mfaStatus. CHALLENGE_REQUIRED means the user must complete an existing factor. ENROLLMENT_REQUIRED means they must create and activate a permitted device factor first. Both responses carry a short-lived pending token instead of a full session. The MFA documentation has copy-paste examples in TypeScript, Java, and Python, plus the full error reference.

A good default

The strongest common setup is password login with enforcement Required and the authenticator-app and/or passkey factors enabled — that puts every user through a real second factor on a channel independent of their password. See Sessions for how pending and full tokens differ.