Two-step sign-in (Field)

After the password, Claimsfy can ask for a 6-digit code from an authenticator app on the person's phone, such as Google Authenticator, Microsoft Authenticator, Authy or 1Password. Someone who learns a password still can't sign in.

• Turn it on for yourself: 👤 → Two-step sign-in → Set it up. Scan the QR code (or type the setup key), enter the code the app shows, and save the 10 recovery codes. Each recovery code works once, for when the phone is lost. The same page makes new recovery codes or turns two-step sign-in off.
• Require it for everyone: 👥 Users & access → Require two-step sign-in for everyone. Anyone without it sets it up right after their next password, before anything else opens. Turn it on for your own account first: Claimsfy won't let an administrator require it without having it.
• Lost phone: in Users & access, the person's status shows On with Reset. Reset turns it off and signs them out everywhere; if it's required, they set it up again at their next sign-in.
• MFA_REQUIRED=1 requires it from the first start.

Built-in protections: a code is good for its 30 seconds (and one step either side, for phone clocks) and can't be used twice; 8 wrong codes lock the code step for 15 minutes; recovery codes are stored only as hashes; and every setup, code sign-in, recovery-code sign-in, wrong code, reset and change goes in the audit history.