> ## Documentation Index
> Fetch the complete documentation index at: https://ownpay.org/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> OwnPay is licensed under AGPL-3.0 and is completely free - no licensing fees.
> Production docs URL: https://ownpay.org/docs - append .md to any page URL for clean markdown.
> OwnPay requires PHP 8.3+, MySQL/MariaDB, and Redis.
> MCP server available at https://ownpay.org/docs/mcp for programmatic documentation queries.
> Use root-relative links (e.g. /quickstart) for internal navigation - do NOT include /docs prefix.
> Plugin development: consult /developer/plugins/ pages for correct interfaces and manifests.
> Canonical locations: API auth = /api/authentication, webhook verification = /api/webhooks, rate limits = /resources/rate-limiting, transaction statuses = /fundamentals/payment-flow.
> The documentation uses the Diataxis framework: Tutorials (learning), How-to (tasks), Reference (lookup), Explanation (understanding).

# Two-Factor Authentication

> Enable TOTP-based two-factor authentication using Google Authenticator or Authy to add a second layer of security to your admin account.

Two-factor authentication (2FA) adds a second verification step to the login process. After entering your email and password, you must provide a time-based one-time password (TOTP) from an authenticator app.

## Compatible apps

* **Google Authenticator** (iOS, Android)
* **Authy** (iOS, Android, desktop)
* **1Password** (built-in TOTP)
* **Bitwarden** (built-in TOTP)

<Info>
  OwnPay uses standard TOTP (RFC 6238). Any authenticator app that supports this standard will work.
</Info>

## Enable 2FA

<Steps>
  <Step>
    Go to **My Account** (click your avatar in the top-right corner).
  </Step>

  <Step>
    Click **Enable 2FA** in the Security section.
  </Step>

  <Step>
    A QR code appears. Scan it with your authenticator app.
  </Step>

  <Step>
    The app displays a 6-digit code. Enter it in the **Verification Code** field.
  </Step>

  <Step>
    **Save your backup codes**. OwnPay generates a set of single-use recovery codes. Store them in a secure location.
  </Step>

  <Step>
    Click **Confirm**. 2FA is now active on your account.
  </Step>
</Steps>

<Warning>
  Backup codes are shown only once. If you lose your authenticator device and do not have backup codes, you will need the super-admin to manually disable 2FA on your account.
</Warning>

## Using 2FA at login

After entering your email and password, a second screen appears asking for your **6-digit verification code**. Open your authenticator app and enter the current code. Codes rotate every 30 seconds.

## Lost device recovery

If you lose access to your authenticator app:

1. On the 2FA login screen, click **Use backup code**
2. Enter one of your saved backup codes
3. Each backup code can only be used once
4. After logging in, disable 2FA and re-enable it with a new authenticator

## 2FA enforcement per role

Super-admins can enforce 2FA for specific roles. When enforced, staff in those roles cannot disable 2FA and must set it up before accessing the dashboard. Configure this in **Settings > Security > Enforce 2FA for roles**.

## Related Pages

* [Login](/docs/security/login) - The login flow with 2FA
* [My Account](/docs/security/my-account) - Manage 2FA and personal security settings
* [Password Reset](/docs/security/password-reset) - Account recovery flow


## Related topics

- [My Account](/docs/security/my-account.md)
- [Invite and manage staff](/docs/people/staff.md)
- [Login](/docs/security/login.md)
- [Password Reset](/docs/security/password-reset.md)
- [Security and Compliance](/docs/resources/security-compliance.md)