> ## Documentation Index
> Fetch the complete documentation index at: https://woku.app/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Two-step authentication (MFA)

> How to enable TOTP on your account, manage backup codes, and disable the second factor

woku supports **MFA TOTP** (one-time codes, 6 digits, every 30
seconds) compatible with any authentication app: Google
Authenticator, 1Password, Authy, Microsoft Authenticator, Bitwarden,
etc.

## Enable MFA

1. In **admin.woku.app**, open your profile (top-right corner →
   your name).
2. Find the **"Two-step authentication"** section and click
   **Enable**.
3. You will see a QR code plus a plain-text secret. Scan the QR
   with your authentication app (or enter the secret manually).
4. Save the **10 backup codes** shown on screen. They are
   shown only once. You can download them as a `.txt`.
5. Enter the 6-digit code shown by your app and confirm.

From that moment on, MFA is active for your account.

## Backup codes

* They are 10 hexadecimal codes of 12 uppercase characters.
* They are used as an **alternative** to the TOTP code when you lose access to
  your app (lost phone, uninstalled app).
* **Each code is consumed when used**. When you have few left,
  regenerate them.
* They are stored on the server as **bcrypt hashes**; you only see them in
  plain text at the moment of generation.

### Regenerate codes

If you lost the list or consumed too many:

1. Profile → Two-step authentication.
2. Enter your current TOTP code (or a backup code you have left).
3. Click **Regenerate backup codes**.
4. The previous 10 are invalidated and 10 new ones appear.

## Disable MFA

1. Profile → Two-step authentication.
2. Enter a valid TOTP code or a backup code.
3. Click **Disable**.

> **Why we ask for a code before disabling:** it prevents
> someone with your stolen session (but without access to your app) from
> disabling your second factor without you noticing.

## Recent verification window

Some sensitive actions (for example, future advanced admin
integrations) require a **recent MFA re-verification**: the
server requires that the last TOTP verification happened in the
last **5 minutes**. If more time has passed, the system asks you to enter the
code before proceeding.

## Recovery on total loss

If you lost your app **and** all your backup codes: contact
support (`team@woku.app`). An internal administrator can disable
MFA after verifying your identity through out-of-band channels. This
process is recorded in your company's [audit log](/docs/en/seguridad/audit-log)
as `auth.unlock`.