# Security methods (MFA) (https://docs.idra.zone/docs/end-users/mfa)

Set up IdRa Verify, passkeys, an authenticator app and other second factors.

Manage your methods in **Settings → Security methods**. You only see the methods your administrator has turned on (plus any you already have). Setting up or removing an authenticator app, and generating backup codes, asks for your password.

| Method | What you need | Phishing-resistant |
| --- | --- | --- |
| **IdRa Verify** (push) | A phone with the IdRa Verify web app | No |
| **Passkeys** | Your device's passkey support (Touch ID, Windows Hello, a phone) or a security key | **Yes** |
| **Authenticator app** (TOTP) | Any TOTP app: 1Password, Google Authenticator, Authy… | No |
| **Backup codes** | Available once an authenticator app is set up. Each code works once | No |
| **Email** | Nothing to set up: codes go to your email address | No |
| **Phone (SMS)**, **Phone (voice call)** | A phone number | No |
| **Security question** | An answer only you know | No (and not a second factor on its own with a password) |
| **YubiKey OTP** | A YubiKey; touch it to enroll | No |
| **Duo Security**, **RSA SecurID** | An account your organization manages | No |

## IdRa Verify

IdRa Verify sends a push to your phone: you approve sign-ins with **Yes, it's me** or reject them with **No, it's not me**. It's an installable web app, so there's nothing to download from an app store.

1. In **Settings → Security methods**, select **Set up IdRa Verify**. A QR code and an 8-character activation code appear (valid 10 minutes, single use).
2. On your phone, scan the QR code (or open `https://<your IdRa address>/verify-app/`).
3. **iPhone:** in Safari, tap Share → **Add to Home Screen** first and open IdRa Verify from the Home Screen. iOS only delivers notifications to installed web apps.
4. Enter the **Activation code** (`XXXX-XXXX`) and a **Device name**, then **Activate** and allow notifications.

You can add several phones. At sign-in, the phone shows the browser, location and IP address of the request. If your organization uses a **number challenge**, tap the number shown on your sign-in screen.

**Didn't sign in?**

  Choose **No, it's not me**. The sign-in is refused and your account is flagged as high risk, so your
  administrators can respond.

Your phone's clock must be accurate (within 2 minutes).

## Passkeys

Select **Add passkey** and follow your browser's prompt. You can rename or remove passkeys later. Passkeys let you sign in with **Sign in with a passkey**, and are the only method accepted by apps that require phishing-resistant verification.

A passkey belongs to the address you created it on. If your organization moves IdRa to a new domain, add your passkeys again.

## Authenticator app

Select **Set up** on Authenticator app, confirm your password, scan the QR code with your TOTP app and enter the 6-digit code. Then generate **backup codes** and store them somewhere safe; each one works once and replaces a code from your app.

## Phone, security question, YubiKey, Duo, RSA

Select **Set up** and follow the prompts. SMS and voice codes can be resent after 30 seconds, and a few per hour at most.

## Password and sessions

- **Change password:** enter your current password and a new one that meets the checklist (12 characters minimum by default). **Sign out of all other sessions** is on by default.
- **Sessions & devices:** shows where you're signed in (device, platform, last used, country). **Remove** signs out one device; **Sign out other sessions** signs out all but this one.