> ## Documentation Index
> Fetch the complete documentation index at: https://ownpay.org/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> OwnPay is licensed under AGPL-3.0 and is completely free - no licensing fees.
> Production docs URL: https://ownpay.org/docs - append .md to any page URL for clean markdown.
> OwnPay requires PHP 8.3+, MySQL/MariaDB, and Redis.
> MCP server available at https://ownpay.org/docs/mcp for programmatic documentation queries.
> Use root-relative links (e.g. /quickstart) for internal navigation - do NOT include /docs prefix.
> Plugin development: consult /developer/plugin-types/ pages for correct interfaces and manifests.

# Two-Factor Authentication (2FA) - Secure Your Admin Account

> Verification screen where users enter a six-digit TOTP code from an authenticator app to complete login when two-factor authentication is enabled.

If Two-Factor Authentication (2FA) is enabled for your account, the login flow requires you to verify your identity using a mobile authenticator app (such as Google Authenticator, Authy, or Bitwarden) after entering your correct email and password.

## Getting here

1. Navigate to the login page and enter your correct **Email or Username** and **Password**
2. Click **Sign In**
3. If 2FA is active, you will be redirected automatically to `/2fa`

## Fields and options reference

| Field / Option        | Type           | Required | Default | Description                                                  |
| --------------------- | -------------- | -------- | ------- | ------------------------------------------------------------ |
| **Verification Code** | Text / Numeric | Yes      | -       | The 6-digit code generated by your authenticator application |
| **Verify**            | Button         | Yes      | -       | Submits and verifies the entered code                        |
| **Cancel & Logout**   | Button / Link  | No       | -       | Cancels the login process and logs you out completely        |

## Step-by-step

1. Open your authenticator app on your mobile device
2. Locate the entry for **OwnPay** (which maps to your login email)
3. Copy or read the current active 6-digit numeric code
4. Enter the code in the **Verification Code** field
5. Click **Verify**
6. Upon successful verification, you will be logged in and redirected to the **Dashboard**

## Configuration guide

* **Clock Drift Tolerance:** The system allows up to 60 seconds (2 time slices) of clock drift between your mobile device and the server
* **Replay Protection:** A code cannot be used more than once
* **Rate Limiting:** Entering too many incorrect codes will lock you out for 5 minutes

## Best practices

* Synchronize the time on your mobile device to ensure the codes match the server's time precisely
* Click **Cancel & Logout** if you are logging in from a public computer and cannot complete the 2FA step
* Do not share your 2FA secret key or authenticator app entries with anyone

<Warning>
  You must submit the code within its 30-second validity window. If the timer expires and shows a new code, type the new code instead.
</Warning>

## Common mistakes and troubleshooting

| Symptom                                   | Likely Cause                                                     | Fix                                                           |
| ----------------------------------------- | ---------------------------------------------------------------- | ------------------------------------------------------------- |
| `Invalid or expired 2FA code` error       | Your mobile device clock is out of sync, or the code has expired | Verify that your phone's time settings are set to automatic   |
| `2FA secret could not be decrypted` error | System decryption key mismatch                                   | Contact your system administrator to revoke and re-enable 2FA |
| `Rate limit exceeded` error               | Too many invalid submissions                                     | Wait 5 minutes for the rate limit window to expire            |

## Related pages

* [Login](/user-guide/auth/login) - The initial credentials screen
* [My Account](/user-guide/account/my-account) - Where to set up and enable/disable 2FA


## Related topics

- [My Account - Profile Settings, Password, and 2FA](/docs/user-guide/account/my-account.md)
- [Security and Compliance - PCI, Encryption, and RBAC](/docs/advanced-topics/security-compliance.md)
- [Login - Sign In to the OwnPay Admin Dashboard](/docs/user-guide/auth/login.md)
- [Staff Management - Add Team Members and Assign Roles](/docs/user-guide/people/staff.md)
- [Troubleshooting - Fix Common Installation and Payment Errors](/docs/advanced-topics/troubleshooting.md)