Multi-Factor Authentication (MFA)

Rivolq supports MFA via TOTP (authenticator apps) and SMS verification codes.

Enrolling MFA

Go to Settings then Security then Set up MFA:

1. 01Choose a method: an authenticator app such as Google Authenticator, 1Password, or Authy, or SMS codes sent to a verified phone number.
2. 02Scan the QR code with your authenticator app, or verify your phone number.
3. 03Save your recovery codes offline.
4. 04Verify with a one-time code to complete enrollment.

An authenticator app is the stronger choice: codes are generated on your device and do not depend on cellular coverage. Use SMS when an authenticator app is not practical, or enroll it as a backup method.

Org-wide enforcement

Under Settings then Security then MFA enforcement, choose Optional, Required for admins, or Required for all. Required for all is right for any production org with sensitive data.

Recovery codes

You receive 10 single-use recovery codes. Save them in a password manager or a printed sheet in a locked drawer, not in email or a phone photo.

Lost device

1. 01Sign in with a recovery code on another device.
2. 02Go to Settings then Security then Reset MFA.
3. 03Re-enroll with the new device; the old enrollment is invalidated. An admin can reset MFA via Settings then Team, the user, then Reset MFA, which is logged. Enroll at least two methods to avoid lockouts.