Multi-Factor Authentication (MFA) adds a second layer of verification when users log in to Orderful with basic authentication (email + password). It protects accounts in the event of a credential leak and is required for users who are not authenticating via SSO.

Supported MFA factors

Orderful supports the following authentication methods via Auth0:

Factor	Description	Example
TOTP	Time-based one-time password	Google Authenticator, Authy
WebAuthn	Biometric or hardware key	Fingerprint, Face ID, YubiKey
Passkey	Device-bound cryptographic key	Platform passkeys on macOS, iOS, Android
Email	One-time code sent to your email	—

Enrollment

Users are prompted to enroll at each login. To enroll:

Log in to Orderful.
When prompted, select Set up MFA (or skip until ready).
Choose your preferred factor and follow the on-screen instructions.
Save your recovery code in a safe place — this is shown once and allows you to recover access if you lose your MFA device.

📘
MFA is not enforced by Orderful for users authenticating through a SAML/OIDC SSO connection. Your organization's identity provider is responsible for managing MFA requirements in that case.

Remember this browser

After completing MFA, you can select Remember this browser to skip the MFA challenge for 30 days on that device and browser. Clearing browser data or switching browsers will require re-authentication.

Recovery codes

During enrollment, Orderful generates a one-time recovery code.
Store it securely. If you lose access to your MFA factor, this code can be used to regain entry to your account.