Multi-Factor Authentication is the RichAPI setting that adds a second step to your sign-in. RichAPI accepts a 6-digit code from a time-based one-time password (TOTP) authenticator application. The setting lives in the Multi-Factor Authentication card on the Profile tab of the Settings page (Account > Settings in the sidebar).

How does RichAPI multi-factor authentication work?

Multi-factor authentication (MFA) adds an extra layer of security on top of your Email and Password. After entering your credentials, RichAPI prompts you for a 6-digit time-based one-time password (TOTP) from your authenticator app (such as Google Authenticator, Microsoft Authenticator, or 1Password).

Sign-in step	What the step proves
Your email and password	You know the password of the account.
The authenticator code, after enrollment	You control the enrolled authenticator device.

What does multi-factor authentication add to a RichAPI account?

Without a factor, one password is the whole defence. A person who learns your password can open your account, your credits, and your API keys. After you enroll a factor, the password alone is no longer enough. The second code comes from an application on your device and never travels by email. RichAPI also blocks the dashboard data of an account that holds a verified factor until the session passes the code.

What do you need before you enroll a factor?

RichAPI adds no separate email-verification step before enrollment. You confirm your email address when you create the account, so it is confirmed before you reach the settings page. Sign in, select Account > Settings, and the Setup a new Factor button is available on the Profile tab.

Requirement	Detail
A signed-in RichAPI account	The Multi-Factor Authentication card is on the Profile tab of the Settings page, not on the Team tab.
An authenticator application	Any TOTP application on a phone, a tablet, or a computer.
A way to scan a QR code	The setup dialog shows a QR code and no text secret key.

Which authenticator apps work with RichAPI?

RichAPI enrolls standard TOTP factors, so any TOTP application works. Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden, Authy, and Apple Passwords are common examples. RichAPI sets the issuer name to RichAPI, so the new entry appears under that name in the application.

RichAPI enrolls no SMS factor and no phone factor. The only factor type in the dashboard is totp.

How to enroll an authenticator app in RichAPI

Sign in at https://app.richapi.ai.
Select Account > Settings in the sidebar. The page opens on the Profile tab.
Scroll to the Multi-Factor Authentication card.
Select Setup a new Factor.
Type a name in the field A memorable name to identify this factor.
Select Set factor name.
Open your authenticator application and scan the QR code.
Type the 6-digit code from the application into the six boxes.
Select Enable Factor.
Wait for the message Factor successfully enrolled.

The name is required and identifies the device later. iPhone 14 is the hint that the dialog shows. The dialog ignores the Escape key and a click outside, so use Cancel to leave it.

CAUTION: Scan the QR code before you leave the dialog. RichAPI shows no text secret key, and a second visit to the dialog creates a new factor instead of the same one.

What does the factor table show after enrollment?

The Multi-Factor Authentication card lists every verified factor on the account in a table. An enrollment that stopped before the first code does not appear in the list.

Column	Value	Meaning
Factor Name	The name that you typed	The label that the sign-in screen shows for this factor.
Type	`TOTP`	The factor type. RichAPI supports this one type.
Status	`verified`	The first code was correct. The factor guards your sign-in.

Each row carries an X button with the tooltip Unenroll this factor.

What does sign-in look like after multi-factor authentication is on?

Open https://app.richapi.ai and type your email and password.
Select Sign in.
Wait for the page /auth/verify and the heading Verify your account.
If the account holds more than one verified factor, select the factor by name.
Type the current 6-digit code from your authenticator application.
Select Submit Verification Code.
Wait for the redirect message on the button. RichAPI opens the page that you asked for.

If the account holds exactly one verified factor, RichAPI selects that factor for you and shows the code field at once. Until the code is correct, every dashboard address returns you to /auth/verify.

How to remove a multi-factor authentication factor

CAUTION: Remove a factor only from a session that already passed the authenticator code. RichAPI rejects the removal and shows the error Please sign-in with your current multi-factor authentication to perform this action.

Select Account > Settings and scroll to the Multi-Factor Authentication card.
Find the row of the factor in the table.
Select the X button on that row.
Read the dialog Unenroll Factor.
Select Yes, unenroll factor.
Wait for the message Factor successfully unenrolled.

CAUTION: Enroll the replacement factor before you remove the last one. An account with no verified factor signs in with the email and password alone.

How do you recover a RichAPI account after you lose the authenticator?

RichAPI issues no recovery codes and no backup codes. The setup dialog shows a QR code and a code field, and nothing else. The sign-in screen has one field for the 6-digit authenticator code and no link for a backup code. No screen in the dashboard redeems a recovery code.

So a lost authenticator device locks you out of the dashboard. Write to [email protected] from the email address on the account and ask for the removal of the factor. Support is the only route back into a locked account.

CAUTION: Enroll a second factor, or keep an encrypted backup of your authenticator. RichAPI issues no recovery codes, and a lost device blocks every dashboard sign-in.

Measure	Effect
Enroll a second factor on another device	The `/auth/verify` screen lists both factors by name. The code from either factor completes the sign-in.
Use an authenticator with an encrypted cloud backup	A replacement device restores the same factor and the same codes.
Keep the account email address current	Support answers a recovery request from the address on the account.

How to fix a failed multi-factor authentication

What you see	Cause	What to do
`Invalid Verification Code` at sign-in	The code expired, or the clock on the device drifted.	Wait for the next code. Turn on automatic time on the device.
`Setup Failed` inside the setup dialog	The first code failed the check.	Close the dialog. Start the enrollment again.
`QR Code Error`	RichAPI did not generate the QR code.	Select Retry. If the failure repeats, write to [email protected].
`Error loading factors list`	The factor list did not load.	Reload the page. On the sign-in screen, this failure signs you out.
`Please sign-in with your current multi-factor authentication to perform this action`	The session never passed the authenticator code.	Sign out, sign in again, type the code, then repeat the action.
Every dashboard address returns to `/auth/verify`	The account holds a verified factor and the session did not pass the code.	Type the current code from the enrolled authenticator application.
No code, because the device is lost	The enrolled authenticator is gone, and RichAPI has no recovery code.	Write to [email protected] from the account email address.

Frequently asked questions

Does RichAPI give recovery codes for multi-factor authentication?

No. RichAPI issues no recovery codes and no backup codes at enrollment, and no dashboard screen redeems one. If you lose the enrolled device, write to [email protected] from the email address on the account.

Does RichAPI multi-factor authentication protect my API key?

No. Multi-factor authentication guards the dashboard sign-in. An API request carries the x-api-key header and passes no authenticator code. To stop a key, revoke it on the API Keys page.

Which authenticator applications work with RichAPI?

Any application that supports standard TOTP codes. Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden, Authy, and Apple Passwords are common examples. The RichAPI entry appears under the issuer name RichAPI.

Can I require multi-factor authentication for every member of my workspace?

No. Each person enrolls a factor on the Profile tab of their own Settings page. RichAPI has no workspace-wide switch that forces enrollment on other members.

Does RichAPI send the second code by SMS?

No. RichAPI enrolls authenticator (TOTP) factors only. The dashboard offers no SMS factor and no phone factor, and the second code never arrives by message or by email.

Does multi-factor authentication change my API or MCP access?

An API request with the x-api-key header is unchanged, and an active MCP connection stays active. A new MCP authorization opens the RichAPI consent screen in your browser, and that browser session must pass the authenticator code first.

Next: Connecting Model Context Protocol (MCP)

Securing Your Account with Multi-Factor Authentication