MFA and Passkeys

Rivolq supports both TOTP-based MFA (authenticator apps) and passkeys (WebAuthn, the phishing-resistant standard).

Enrolling MFA

Go to Settings then Security then Set up MFA:

1. 01Choose a method: an authenticator app such as Google Authenticator, 1Password, or Authy, or a passkey backed by a YubiKey, your phone's secure enclave, or Touch ID/Face ID.
2. 02Scan the QR code or register the passkey.
3. 03Save your recovery codes offline.
4. 04Verify with a one-time code to complete enrollment.

Passkeys are better than TOTP because they are phishing-resistant and faster. Use passkeys where supported, with TOTP as a backup.

Org-wide enforcement

Under Settings then Security then MFA enforcement, choose Optional, Required for admins, or Required for all. Required for all is right for any production org with sensitive data.

Recovery codes

You receive 10 single-use recovery codes. Save them in a password manager or a printed sheet in a locked drawer, not in email or a phone photo.

Lost device

1. 01Sign in with a recovery code on another device.
2. 02Go to Settings then Security then Reset MFA.
3. 03Re-enroll with the new device; the old enrollment is invalidated. An admin can reset MFA via Settings then Team, the user, then Reset MFA, which is logged. Enroll at least two methods to avoid lockouts.