MFA (multi-factor auth)

Multi-factor authentication adds a second factor to LakeSail sign-in: a 6-digit time-based code from an authenticator app (TOTP). This page covers enrollment, Owner reset, and recovery.

When MFA is required

MFA is required when Require 2FA is enabled under Settings → Access.

For users in such an org, MFA enrollment is part of the signup flow:

• After creating the account and verifying email, the signup wizard surfaces a 2FA setup step.
• The user scans a QR code with an authenticator app (Google Authenticator, 1Password, Authy, Bitwarden, etc.) and enters a 6-digit code to confirm enrollment.
• They can then sign in.

If MFA is optional in the org, members can enable it themselves from Account settings → Security.

SSO and MFA

Password sign-in uses the member's LakeSail TOTP code. SSO relies on MFA completed at the identity provider; LakeSail does not add a local TOTP prompt after SSO.

When Require 2FA is enabled, LakeSail accepts an SSO sign-in when the provider reports MFA in its amr or acr claim. If the provider enforces MFA but does not report it, an Owner can attest to that policy in the provider's Edit view. Otherwise, LakeSail refuses the SSO sign-in. See SSO and MFA for setup details.

Enroll in MFA (self-service)

1. Open Account settings → Security.
2. Click Set up 2FA.
3. Scan the QR code with your authenticator app.
4. Enter the current 6-digit code from the app to confirm.
5. Save the recovery codes that LakeSail shows you.

Save your recovery codes

Recovery codes let you sign in if you lose your authenticator device without waiting for an Owner to reset MFA. Save them somewhere outside the device, such as a password manager or a printed copy. LakeSail can't show them to you again.

Sign in with MFA

1. Enter your email and password as usual.
2. When prompted, open your authenticator app and enter the current 6-digit code.
3. Continue into LakeSail.

The code rotates every 30 seconds. If your code is rejected, your device clock may be drifting. Most authenticator apps have a "sync time" option.

Lost device: use a recovery code

If you've lost the device with your authenticator:

1. On the MFA prompt screen, click Use a recovery code.
2. Enter one of the recovery codes you saved at enrollment.
3. Sign in.

Each recovery code works once. After signing in, immediately re-enroll on a new device. Open Account settings → Security, click Reset 2FA, and follow the enroll steps again. Generating new recovery codes invalidates the old ones.

Reset your own MFA

From Account settings → Security → Reset 2FA. The current TOTP secret is discarded; you re-enroll from scratch and get fresh recovery codes.

Owner reset

When a member loses their device and has no recovery codes left, an Owner can reset their MFA on their behalf:

1. Open Settings → Members and click the member.
2. Click Reset MFA (or Reset 2FA).
3. Confirm.

After the reset, the member's existing TOTP secret is invalidated. They'll be prompted to re-enroll on their next sign-in.

This action is auditable: the actor and timestamp are recorded. It's appropriate for support workflows but not something to do casually.

Verify identity first

Before resetting MFA, verify the requester is who they claim to be through a channel outside of LakeSail, such as a Slack message, phone call, or help-desk ticket. Resetting MFA after a phishing request can lead to account takeover.

Disable MFA

If your org's policy permits, members can disable MFA from Account settings → Security. If MFA is org-required, the disable option won't be available; you'll have to leave the org or change the policy.

API reference

• MFA: ResetMyMfa (self-service), AdminResetMfa (Owner reset).