Security methods (MFA)
Set up IdRa Verify, passkeys, an authenticator app and other second factors.
Manage your methods in Settings → Security methods. You only see the methods your administrator has turned on (plus any you already have). Setting up or removing an authenticator app, and generating backup codes, asks for your password.
| Method | What you need | Phishing-resistant |
|---|---|---|
| IdRa Verify (push) | A phone with the IdRa Verify web app | No |
| Passkeys | Your device's passkey support (Touch ID, Windows Hello, a phone) or a security key | Yes |
| Authenticator app (TOTP) | Any TOTP app: 1Password, Google Authenticator, Authy… | No |
| Backup codes | Available once an authenticator app is set up. Each code works once | No |
| Nothing to set up: codes go to your email address | No | |
| Phone (SMS), Phone (voice call) | A phone number | No |
| Security question | An answer only you know | No (and not a second factor on its own with a password) |
| YubiKey OTP | A YubiKey; touch it to enroll | No |
| Duo Security, RSA SecurID | An account your organization manages | No |
IdRa Verify
IdRa Verify sends a push to your phone: you approve sign-ins with Yes, it's me or reject them with No, it's not me. It's an installable web app, so there's nothing to download from an app store.
- In Settings → Security methods, select Set up IdRa Verify. A QR code and an 8-character activation code appear (valid 10 minutes, single use).
- On your phone, scan the QR code (or open
https://<your IdRa address>/verify-app/). - iPhone: in Safari, tap Share → Add to Home Screen first and open IdRa Verify from the Home Screen. iOS only delivers notifications to installed web apps.
- Enter the Activation code (
XXXX-XXXX) and a Device name, then Activate and allow notifications.
You can add several phones. At sign-in, the phone shows the browser, location and IP address of the request. If your organization uses a number challenge, tap the number shown on your sign-in screen.
Didn't sign in?
Choose No, it's not me. The sign-in is refused and your account is flagged as high risk, so your administrators can respond.
Your phone's clock must be accurate (within 2 minutes).
Passkeys
Select Add passkey and follow your browser's prompt. You can rename or remove passkeys later. Passkeys let you sign in with Sign in with a passkey, and are the only method accepted by apps that require phishing-resistant verification.
A passkey belongs to the address you created it on. If your organization moves IdRa to a new domain, add your passkeys again.
Authenticator app
Select Set up on Authenticator app, confirm your password, scan the QR code with your TOTP app and enter the 6-digit code. Then generate backup codes and store them somewhere safe; each one works once and replaces a code from your app.
Phone, security question, YubiKey, Duo, RSA
Select Set up and follow the prompts. SMS and voice codes can be resent after 30 seconds, and a few per hour at most.
Password and sessions
- Change password: enter your current password and a new one that meets the checklist (12 characters minimum by default). Sign out of all other sessions is on by default.
- Sessions & devices: shows where you're signed in (device, platform, last used, country). Remove signs out one device; Sign out other sessions signs out all but this one.