Skip to main content
woku supports MFA TOTP (one-time codes, 6 digits, every 30 seconds) compatible with any authentication app: Google Authenticator, 1Password, Authy, Microsoft Authenticator, Bitwarden, etc.

​
Enable MFA

  1. In admin.woku.app, open your profile (top-right corner → your name).
  2. Find the “Two-step authentication” section and click Enable.
  3. You will see a QR code plus a plain-text secret. Scan the QR with your authentication app (or enter the secret manually).
  4. Save the 10 backup codes shown on screen. They are shown only once. You can download them as a .txt.
  5. Enter the 6-digit code shown by your app and confirm.
From that moment on, MFA is active for your account.

​
Backup codes

  • They are 10 hexadecimal codes of 12 uppercase characters.
  • They are used as an alternative to the TOTP code when you lose access to your app (lost phone, uninstalled app).
  • Each code is consumed when used. When you have few left, regenerate them.
  • They are stored on the server as bcrypt hashes; you only see them in plain text at the moment of generation.

​
Regenerate codes

If you lost the list or consumed too many:
  1. Profile → Two-step authentication.
  2. Enter your current TOTP code (or a backup code you have left).
  3. Click Regenerate backup codes.
  4. The previous 10 are invalidated and 10 new ones appear.

​
Disable MFA

  1. Profile → Two-step authentication.
  2. Enter a valid TOTP code or a backup code.
  3. Click Disable.
Why we ask for a code before disabling: it prevents someone with your stolen session (but without access to your app) from disabling your second factor without you noticing.

​
Recent verification window

Some sensitive actions (for example, future advanced admin integrations) require a recent MFA re-verification: the server requires that the last TOTP verification happened in the last 5 minutes. If more time has passed, the system asks you to enter the code before proceeding.

​
Recovery on total loss

If you lost your app and all your backup codes: contact support (team@woku.app). An internal administrator can disable MFA after verifying your identity through out-of-band channels. This process is recorded in your company’s audit log as auth.unlock.