Step 01
Step 1
Scan a QR code in your authenticator app of choice — Google, Microsoft, Aegis, 1Password all work.
Auth & IDRetail + B2B· marketing-claim · totp-on-destructive-admin
TOTP MFA.
Time-based one-time codes from your authenticator app — gates every destructive action.
The problem
Why this exists.
Partner-portal accounts and consumer accounts that hold high-value goals need a second factor that survives a SIM-swap.
We want one MFA primitive used uniformly across consumer mobile, partner portal, and admin tooling so the audit story is the same on every surface.
How it works · 3 steps
From input to outcome.
- Step 02
Step 2
Type a 6-digit code on enrolment to prove it is wired; we never see your seed in plaintext after that.
- Step 03
Step 3
Every destructive admin operation re-prompts for a fresh TOTP token — pause partner, approve self-heal, rotate keys.
Under the hood
The models and routes behind it.
Models called
No models cite this feature directly — backing logic is deterministic Python.
API routes
- POST /api/v1/auth
Compliance posture
- QR code is rendered client-side via the qrcode library — no third-party network call.
- DPDP-aligned control — disable from /settings/security with a confirming TOTP token; recovery codes optional.
- Audit log captures every TOTP-gated write under audit-trail.
What it's not
TOTP is a verification gate, not a recovery path. Lost authenticator = sign-in via email magic link plus identity-document verification on partner portal.
Related · features & stories