# Multi-factor authentication

A step of the [Cloud application](https://gradus.kazet.blog/tree/cloud-application) tree on Gradus, in the Security area: Secrets, auth, TLS, input.

Page: https://gradus.kazet.blog/tree/cloud-application/step/multi-factor-auth

Add a second factor with recovery codes, set up and turned off in settings. A hosted provider does most of this for you.

Usually comes after: [Settings page](https://gradus.kazet.blog/tree/cloud-application/step/settings-page).

## Prompt for your AI assistant

```
Read the sign-in decision record in docs/decisions. Add multi-factor authentication. On a hosted provider, turn it on and start enrolment from settings. For own passwords, use TOTP through a maintained library with the secret encrypted at rest, one-time recovery codes stored only as hashes and throttled attempts, asked for at sign-in after the password. Ask for a fresh sign-in to turn it off and email the account when it is turned on or off. Write in docs/runbooks how someone who lost both the device and the codes gets back in.
```

Every step of the tree: https://gradus.kazet.blog/tree/cloud-application/llms.txt