> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cekura.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Two-Factor Authentication
> Set up authenticator-app MFA for your account and require it for every user in your Cekura organization
export const CopyPageButton = () => {
if (typeof window !== 'undefined') {
setTimeout(function () {
if (document.getElementById('ck-tools')) return;
var anchor = document.getElementById('content-area') || document.querySelector('.mdx-content');
if (!anchor) return;
if (!document.getElementById('ck-style')) {
var s = document.createElement('style');
s.id = 'ck-style';
s.textContent = '#ck-tools{position:absolute;top:6px;right:0;z-index:100;font-family:inherit;}' + '.ck-row{display:inline-flex;align-items:stretch;border:1px solid rgba(0,0,0,0.15);border-radius:8px;overflow:hidden;background:#fff;}' + ':root.dark .ck-row{background:rgba(255,255,255,0.06);border-color:rgba(255,255,255,0.12);}' + '.ck-btn{padding:5px 12px;border:none;background:none;cursor:pointer;font-size:13px;font-weight:500;font-family:inherit;color:#374151;}' + ':root.dark .ck-btn{color:#d1d5db;}' + '.ck-btn:hover{background:rgba(0,0,0,0.04);}' + ':root.dark .ck-btn:hover{background:rgba(255,255,255,0.06);}' + '.ck-chevron{padding:5px 8px;border:none;background:none;cursor:pointer;font-size:14px;font-family:inherit;color:#374151;}' + ':root.dark .ck-chevron{color:#d1d5db;}' + '.ck-chevron:hover{background:rgba(0,0,0,0.04);}' + ':root.dark .ck-chevron:hover{background:rgba(255,255,255,0.06);}' + '.ck-divider{width:1px;background:rgba(0,0,0,0.12);flex-shrink:0;}' + ':root.dark .ck-divider{background:rgba(255,255,255,0.12);}' + '.ck-dd{position:absolute;top:calc(100% + 4px);right:0;min-width:180px;background:#fff;border:1px solid rgba(0,0,0,0.12);border-radius:8px;box-shadow:0 4px 12px rgba(0,0,0,0.1);padding:4px;display:none;z-index:200;}' + ':root.dark .ck-dd{background:#1f2937;border-color:rgba(255,255,255,0.1);box-shadow:0 4px 16px rgba(0,0,0,0.35);}' + '.ck-item{display:block;width:100%;padding:7px 12px;border:none;background:none;border-radius:6px;cursor:pointer;font-size:13px;font-family:inherit;text-align:left;color:#374151;}' + ':root.dark .ck-item{color:#d1d5db;}' + '.ck-item:hover{background:rgba(0,0,0,0.05);}' + ':root.dark .ck-item:hover{background:rgba(255,255,255,0.07);}';
document.head.appendChild(s);
}
var wrap = document.createElement('div');
wrap.id = 'ck-tools';
var row = document.createElement('div');
row.className = 'ck-row';
var mainBtn = document.createElement('button');
mainBtn.className = 'ck-btn';
mainBtn.textContent = 'Copy page';
var divider = document.createElement('span');
divider.className = 'ck-divider';
var chevron = document.createElement('button');
chevron.className = 'ck-chevron';
chevron.textContent = '▾';
var dd = document.createElement('div');
dd.className = 'ck-dd';
function closeDD() {
dd.style.display = 'none';
}
function openDD() {
dd.style.display = 'block';
}
chevron.onclick = function (e) {
e.stopPropagation();
if (dd.style.display === 'block') {
closeDD();
} else {
openDD();
}
};
document.addEventListener('click', function (e) {
if (!e.target.closest('#ck-tools')) {
closeDD();
}
});
document.addEventListener('keydown', function (e) {
if (e.key === 'Escape') {
closeDD();
}
});
function makeItem(label, fn) {
var b = document.createElement('button');
b.className = 'ck-item';
b.textContent = label;
b.onclick = function () {
fn();
closeDD();
};
return b;
}
function getMarkdown() {
var walk = function (node) {
if (!node) return '';
if (node.nodeType === 3) return node.textContent || '';
if (node.nodeType !== 1) return '';
var tag = node.tagName.toLowerCase();
var skip = ['script', 'style', 'svg', 'noscript', 'button', 'iframe'];
if (skip.indexOf(tag) !== -1) return '';
if (node.id === 'ck-tools') return '';
var ch = Array.from(node.childNodes).map(walk).join('');
if (tag === 'h1') return '\n# ' + ch.trim() + '\n\n';
if (tag === 'h2') return '\n## ' + ch.trim() + '\n\n';
if (tag === 'h3') return '\n### ' + ch.trim() + '\n\n';
if (tag === 'p') return '\n' + ch.trim() + '\n\n';
if (tag === 'pre') return '\n```\n' + node.textContent.trim() + '\n```\n\n';
if (tag === 'li') return '- ' + ch.trim() + '\n';
if (tag === 'code') return '`' + ch.trim() + '`';
return ch;
};
var content = document.querySelector('.mdx-content') || document.getElementById('content-area') || document.body;
return walk(content).replace(/\n\n\n+/g, '\n\n').trim();
}
function copyMd() {
var md = getMarkdown();
navigator.clipboard.writeText(md).then(function () {
mainBtn.textContent = 'Copied!';
setTimeout(function () {
mainBtn.textContent = 'Copy page';
}, 2000);
});
}
function viewMd() {
var md = getMarkdown();
var safe = md.split('&').join('&').split('<').join('<').split('>').join('>');
var html = '' + safe + '';
window.open(URL.createObjectURL(new Blob([html], {
type: 'text/html'
})), '_blank');
}
function openClaude() {
var prompt = 'Can you read this Cekura docs page ' + window.location.href + ' so I can ask you questions?';
window.open('https://claude.ai/new?q=' + encodeURIComponent(prompt), '_blank');
}
mainBtn.onclick = copyMd;
dd.appendChild(makeItem('Copy page', copyMd));
dd.appendChild(makeItem('View as Markdown', viewMd));
dd.appendChild(makeItem('Open in Claude', openClaude));
row.appendChild(mainBtn);
row.appendChild(divider);
row.appendChild(chevron);
wrap.appendChild(row);
wrap.appendChild(dd);
anchor.style.position = 'relative';
anchor.insertBefore(wrap, anchor.firstChild);
}, 50);
}
return null;
};
Two-factor authentication (2FA), also called multi-factor authentication (MFA), adds a one-time code from an authenticator app to the Cekura sign-in flow. Users configure 2FA individually, and organization admins can require it for everyone in the organization.
## Before you begin
* Install a time-based one-time password (TOTP) authenticator app. See the options below.
* Sign in to the [Cekura dashboard](https://dashboard.cekura.ai).
* You must be an organization admin to enforce 2FA for the whole organization.
### Authenticator app options
Cekura works with standards-based TOTP authenticator apps, including:
* **Google Authenticator:** [Android](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2) or [iPhone and iPad](https://apps.apple.com/app/google-authenticator/id388497605)
* **Microsoft Authenticator:** [Official download page](https://www.microsoft.com/en-us/security/mobile-authenticator-app)
* **Authy:** [Official download page](https://www.authy.com/download/)
* **1Password:** [Set up one-time passwords](https://support.1password.com/one-time-passwords/)
You can use another authenticator if it supports six-digit TOTP codes and QR-code enrollment.
Before enforcing 2FA organization-wide, notify your users and ask them to complete their account setup. After enforcement is enabled, users who have not configured 2FA must finish setup before they can continue using the organization.
## Enable 2FA for your account
Each user must enroll their own authenticator app.
1. Open [Account Settings](https://dashboard.cekura.ai/settings).
2. Find the **Two-Factor Authentication** card. The **MFA Status** shows whether protection is enabled, disabled, or awaiting verification.
3. Select **Enable MFA**.
4. In your authenticator app, add a new account and scan the QR code shown by Cekura.
5. If you cannot scan the QR code, select **Unable to scan?** and enter the displayed manual setup key in your authenticator app.
6. Enter the current six-digit verification code generated by the authenticator app. Cekura verifies the code after all six digits are entered.
7. Confirm that **MFA Status** changes to **Enabled**.
Authenticator codes expire quickly. If a code is rejected, wait for the next code and make sure your device date and time are set automatically.
### Resume an incomplete setup
If the status is **Unverified**, the authenticator factor was created but setup was not completed. Select **Reload QR Code**, scan the new QR code, and enter the six-digit code to finish enrollment.
## Require 2FA for the organization
Only an organization admin can change this setting.
1. Make sure 2FA is already enabled on your own account.
2. Open [Organization Settings](https://dashboard.cekura.ai/settings/org/general).
3. Find **Require 2FA for All Users**.
4. Turn the switch on.
5. Select **Save Changes** at the top of the page.
6. Confirm that the dashboard shows **Organization settings updated successfully**.
After enforcement is enabled:
* Users who have not enrolled are directed to the 2FA setup flow.
* Enrolled users are asked for the current six-digit authenticator code when additional verification is required.
* A user cannot continue into the organization until the required 2FA step is complete.
Share the [account setup link](https://dashboard.cekura.ai/settings) with all organization members before turning on enforcement.
## Verify the rollout
1. Ask a member to sign out and sign back in.
2. Confirm that a member without 2FA is prompted to set it up.
3. Confirm that a member with 2FA can enter their authenticator code and access the organization.
4. Ask each member to verify that their **MFA Status** is **Enabled** in [Account Settings](https://dashboard.cekura.ai/settings).
## Disable or reset 2FA
Users can select **Disable MFA** from the **Two-Factor Authentication** card in Account Settings. If the organization requires 2FA, the user must enroll again before continuing to use the organization.
If a user loses access to their authenticator app and cannot sign in, contact [Cekura Support](mailto:support@cekura.ai) for assistance.
## Troubleshooting
### I cannot see the organization enforcement setting
The **Require 2FA for All Users** control is an organization-level setting. Confirm that you are an admin of the selected organization and that you opened **Settings → Organization → General**.
### The verification code is rejected
* Enter the newest code displayed by the authenticator app.
* Make sure the phone or device running the authenticator app uses automatic date and time.
* Check that you scanned the latest QR code if setup was restarted.
### The QR code is no longer available
If the MFA status is **Unverified**, select **Reload QR Code** to generate a new code and complete enrollment.
## Recommended rollout checklist
* Enable 2FA for all organization admins first.
* Tell members when enforcement will begin.
* Share this guide and the [Account Settings](https://dashboard.cekura.ai/settings) link.
* Turn on **Require 2FA for All Users** and save the organization settings.
* Verify the flow with both an enrolled user and a user who has not yet enrolled.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.