Documentation
MFA
Users can enroll TOTP and passkeys with recovery codes. Workspaces on Enterprise can require MFA for members.
Personal enrollment
Settings → Security: enable authenticator apps (TOTP), passkeys (WebAuthn), and view recovery codes. Challenge flow: /mfa.
Workspace policy
Enterprise entitlement mfa_policy lets admins require MFA for the workspace. Without Enterprise, personal MFA still works — org-wide require is gated.
Limitations
- WebAuthn rpID follows
BETTER_AUTH_URLhostname — production must be HTTPS.