Multi-factor authentication

Multi-factor authentication (MFA) adds a second step to sign-in, after your password or passwordless login. Unit Oncall supports three kinds of second factor, and you can enable more than one at the same time for redundancy.

Available second factors

Factor	How it works	Satisfies `require_mfa`	Where to set it up
Authenticator app (TOTP)	Time-based one-time codes from an app such as Google Authenticator, 1Password, or Authy.	✓	Account settings → security.
Email code	A one-time code sent to your account email at sign-in.	—	Account settings → security.
Passkey (as second factor)	A device passkey used as the second step after a password.	✓	Account settings → security.

Email codes are accepted as a second factor on accounts that have already enrolled, but they do not satisfy an Organization's require_mfa policy on their own — an Organization that requires MFA expects every member to have either TOTP or a passkey.

Setting up an authenticator app

In your account settings, start the authenticator (TOTP) setup.
Scan the QR code with your authenticator app, or enter the shown secret manually.
Enter the current 6-digit code to confirm the app is in sync.
Save the recovery codes that are shown (see below).

Recovery codes

When you finish setting up an authenticator app, Unit Oncall shows a set of one-time recovery codes. Store them somewhere safe and separate from your phone. Each code can be used once, and they let you sign in if you lose access to your second factor (for example, a lost phone). Treat them like passwords.

Passkeys as a second factor

A passkey can be used two ways:

As a primary, passwordless sign-in (covered in Authentication).
As a second factor after your password.

You can register more than one passkey — for example one on your laptop and one on your phone — so losing a single device does not lock you out.

Email codes

If you enable email-based 2FA, Unit Oncall emails a one-time code at sign-in. This is convenient because it needs no extra app, but it depends on access to your mailbox, so we recommend pairing it with an authenticator app or passkey.

Requiring MFA across an Organization

Organization owners and admins can make MFA mandatory:

require_mfa — every member must have at least one second factor (TOTP or passkey). Until they enroll, non-owners are blocked from entering the Organization.
mfa_step_up_enabled — re-prompt members for their second factor at most once every 24 hours. Only takes effect when require_mfa is on.

See Organization settings for the exact fields and validation rules.

Authentication — sign-in methods and passwordless login.
SSO — provider-based sign-in requirements.
Organization settings — require_mfa and step-up options.