> ## Documentation Index
> Fetch the complete documentation index at: https://docs.praxis-ai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Two-Step Verification (MFA)

> Add an email-based second factor to your Pria account. After turning it on, signing in from a new browser or location requires a 6-digit code sent to your inbox.

Pria supports opt-in email Multi-Factor Authentication (MFA). When enabled, password and OAuth (Google, GitHub, Facebook) sign-ins from a **new** browser or network require a 6-digit code emailed to your account address. Browsers you've already verified stay trusted for 7 days, so day-to-day use stays friction-less.

<Info>
  **Who should turn this on?** Anyone with admin privileges is strongly encouraged to enable MFA — admin accounts can read cross-institution data, audit logs, and billing. Standard users can opt in voluntarily.
</Info>

***

## Turning MFA on

<Steps>
  <Step title="Open My Profile → Two-Step Verification">
    From the user menu, choose **My Profile** and scroll to the **Two-step verification (email)** section.
  </Step>

  <Step title="Toggle 'Require a 6-digit email code on new devices'">
    Pria immediately:

    1. Marks your account as MFA-enabled
    2. Sends a 6-digit verification code to your email
    3. Switches the screen to the verification entry form

    The verification step is part of enabling — it proves Pria can reach your inbox so you don't accidentally lock yourself out.
  </Step>

  <Step title="Enter the 6-digit code">
    Check your email (the address you sign in with). Type or paste the code into the six boxes — the form auto-submits when the sixth digit lands. On iOS the keyboard suggestion bar surfaces the code straight from Mail; tap it once to fill all six boxes.

    <Tip>
      **The code expires in 5 minutes.** If you mistyped 5 times in a row, the code is burned — click **Resend code** to get a new one (30-second cooldown between resends).
    </Tip>
  </Step>

  <Step title="You're done — green checkmark, redirect">
    A short success animation confirms verification, then Pria redirects you back into the app. This browser is now a **trusted device** for the next 7 days; you won't see another MFA prompt unless your IP changes drastically or 7 days pass.
  </Step>
</Steps>

### What if I can't get the email?

Click **Cancel** on the verification screen. Pria rolls your account back to MFA-disabled automatically, so you're never stuck in a half-enabled state. Check your spam folder, fix any email delivery issue, then try again. If your account's email address itself is wrong, edit it in your profile first.

***

## Signing in once MFA is on

<Steps>
  <Step title="Sign in normally — password or OAuth">
    Enter your credentials (or click the Google / GitHub / Facebook button) as usual.
  </Step>

  <Step title="Pria checks for a trusted device">
    If you're using the **same** browser within the 7-day window and your network hasn't changed dramatically, you go straight in — no code prompt.
  </Step>

  <Step title="Enter the code if prompted">
    On a new browser, after a long break, or from a different network, Pria emails you a fresh 6-digit code. Same form, same auto-submit, same trusted-device cookie issued on success.
  </Step>
</Steps>

<Note>
  **"Trusted" doesn't mean "forever".** Trusted-device cookies expire after 7 days (or whatever your administrator configures). If you sign out and back in on the same browser, you stay trusted — the cookie survives logout. If you clear cookies, you'll re-verify on the next login.
</Note>

***

## Managing your trusted devices

From **My Profile → Two-step verification**, the **Sign out trusted devices** button revokes **every** browser you've previously verified. The next login from any device — including the one you're using now — requires a fresh 6-digit code.

Useful when:

* You signed in on a shared / public computer and forgot to log out properly
* You lost or sold a device that had access
* You want to refresh your security posture after a suspected password compromise

This action does **not** sign you out of your current session — your active JWT keeps working until normal expiry. It only invalidates the MFA-skip cookies, so your next fresh login forces verification.

***

## Turning MFA off

Toggle **Two-step verification** off in your profile. Pria:

1. Records the change in the audit log
2. Clears your trusted-device list (so the cookies still in browsers become useless)
3. Leaves your active session alone — your current JWT keeps working

Your next sign-in proceeds normally with just password or OAuth, no code prompt.

***

## Recovery

If you've locked yourself out (lost access to your email, mailbox full, etc.):

* **Standard users:** contact your instance administrator. They can toggle MFA off on your account from the admin Users panel.
* **Instance admins:** another admin on your instance can disable MFA for you. If no other admin is available, contact the Praxis AI team at [humans@praxis-ai.com](mailto:humans@praxis-ai.com).

Backup codes aren't supported in this initial release — the recovery path is admin-assisted. We're tracking this for a future iteration.

***

## What gets logged

Every MFA-related action — enabling, disabling, code issued, code verified, wrong code, trusted-device added/revoked, prompt dismissed — is written to a per-user audit log. Administrators with the appropriate entitlement can review these events from the Users panel. This is for compliance and security audit; it does not include your password or the actual code, only metadata (timestamps, IP, user-agent).