---
title: "Multi-Factor Authentication (MFA)"
description: "Protect accounts using Time-based One-Time Passwords (TOTP), SMS OTP, and backup recovery codes."
order: 3
category: "Authentication"
updated: "2026-10-13"
---

# Multi-Factor Authentication (MFA)

AuthSetu provides comprehensive multi-factor authentication (MFA) to meet modern compliance standards including ISO 27001, SOC 2, and RBI digital payment guidelines.

## Supported Factors

- **TOTP Authenticator Apps**: Google Authenticator, 1Password, Microsoft Authenticator.
- **SMS OTP**: Indian DLT-compliant SMS delivery via high-reliability gateways.
- **Cryptographic Recovery Codes**: 10 single-use recovery codes hashed with SHA-256 upon generation.

## Enforcing MFA at the Workspace or Organization Level

Organization owners can enforce mandatory MFA across all workspace members with a single configuration toggle:

```bash
curl -X PATCH https://api.authsetu.com/v1/organizations/org_12345 \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"require_mfa": true}'
```