Two-factor authentication
Enrol
Settings → Access → Two-factor authentication → Enrol. Scan the QR with any TOTP authenticator (Aegis / 1Password / Authy / Google Authenticator). Confirm with a 6-digit code; Citadel persists the factor and shows your recovery codes.
Recovery codes
Ten single-use base32 codes are revealed once. Save them in your password manager immediately — they never display again. Citadel stores only SHA-256 hashes of the codes; the plaintext cannot be reconstructed.
Sign-in
After password sign-in, Citadel checks whether your session meets the second-factor requirement. If you have a verified TOTP factor but the current session is single-factor, you're bounced to /auth/mfa-challenge and prompted for a 6-digit TOTP code or a recovery code.
Step-up
Some actions (revoking a trusted device, rotating an OAuth secret, regenerating recovery codes) require recent MFA — you re-prove with TOTP within a 5-minute window. The challenge appears as a 412 response that the SPA translates into a step-up modal.
Recovery flow
If you lose your TOTP authenticator and recovery codes, contact support and use the account recovery form. Self-service reset is intentionally out of scope.
Disable
Settings → Access → Two-factor authentication → Disable. Requires a recent MFA assertion (so a stolen-password session can't disable two-factor before the holder notices).