Multi-factor authentication

Multi-factor authentication (MFA) adds a changing code after your password. HERAIOT uses standard time-based one-time passwords, so it works with Google Authenticator, Microsoft Authenticator, 1Password, Authy, and other compatible authenticator apps.

Enable MFA

Open security settings

Confirm your password

Enter your current HERAIOT password and select Set up MFA. The setup page shows a QR code and a manual setup key. Setup expires after 10 minutes and MFA remains disabled until verification succeeds.

Add HERAIOT to your authenticator

Scan the QR code. If scanning is unavailable, add an account manually and enter the setup key exactly as shown. Never send the QR code or key to another person.

Verify a fresh code

Enter the current six-digit code from the app and select Verify and enable MFA. Codes change every 30 seconds; if one is about to expire, wait for the next one.

Save the recovery codes

HERAIOT displays 10 recovery codes once. Download or copy them into a secure password manager, confirm that they are saved, then select Done. Each code works once and is removed after use.

Your authenticator secret and recovery codes can unlock your account. Do not paste them into email, chat, support tickets, or screenshots. HERAIOT support should never ask for an active code.

Enter your email and password as usual. If MFA is enabled, the next screen asks for an authenticator or recovery code. Password verification alone does not create a session.

The same requirement applies when you authorize a new MCP OAuth connection. Existing MCP grants continue until they expire or are revoked; enabling MFA does not revoke an already-authorized MCP client.

Use a recovery code

If the authenticator app is unavailable, enter one saved recovery code in the same code field. A recovery code cannot be reused. Remove it from your stored list after a successful sign-in.

If you lose both the authenticator and every recovery code, contact your workspace administrator or support. Password reset does not disable MFA.

Disable or replace MFA

Open Settings → Multi-factor authentication. To disable it, enter your current password and a current authenticator code or an unused recovery code. To move to a new authenticator, disable MFA while the old factor is still available, then enable it again and save the newly generated recovery codes.

Enabling or disabling MFA invalidates other HERAIOT platform sessions. The browser making the change receives a replacement session; other browsers and old platform API tokens must sign in or be created again.

Code rejected?

Wait for a new code and try again; a code already accepted by HERAIOT cannot be reused.
Set your phone’s date and time to automatic. Authenticator codes depend on accurate time.
Confirm you selected the HERAIOT entry in the authenticator app.
After five failed attempts, wait five minutes before trying again.
A recovery code is hexadecimal text and may be longer than six digits; enter the whole code.

See Troubleshooting if sign-in still fails.