Skip to main content
Granular MFA lets your app choose which wallet actions require MFA. For example, your app can require MFA when a user exports a wallet or sends a large transfer, and let routine signing go through without a prompt. With standard transaction MFA, every wallet action requires MFA from enrolled users. With granular MFA, your app’s policies decide which actions require MFA. Privy evaluates those policies in its secure enclave each time a user authorizes an action. Granular MFA works with Privy authentication and JWT-based authentication, in both client-side and server-side integrations.

​
Use cases

  • Wallet export. Require MFA before a user exports a private key or seed phrase.
  • Large transfers. Require MFA above a set amount, and let small transfers through without it.
  • Sensitive messages. Require MFA to sign specific messages, such as an ownership proof.
  • Every action. Require MFA for every wallet action, and require every user to enroll.
See granular MFA policies for example policies.

​
Benefits

  • Users complete MFA only for the actions your app’s policies select. Other actions don’t prompt for MFA.
  • Privy enforces MFA alongside the user’s authentication credentials. Actions that require MFA need both a valid user session and a completed MFA verification.
  • Client-side SDKs, like the React SDK, prompt users to enroll or verify, then retry the request. Server SDKs accept the MFA token in the authorization context.

​
How it works

Policy rules require MFA with the ALLOW_WITH_MFA action. Each rule takes one of three actions: When more than one rule matches a request, the action highest in this table applies. Privy denies a request that matches no rule.
1

The user authorizes a wallet action

The user signs the request with their user key.
2

Privy evaluates the wallet's policies

Inside the enclave, Privy checks the request against every matching rule, and applies the action that ranks highest in the table above.
3

Privy checks for MFA

If an ALLOW_WITH_MFA rule matches, Privy allows the request only if the user key records an unexpired MFA verification. Otherwise, it returns mfa_required or missing_mfa_enrollment.
4

The user completes MFA, and the request is retried

The user enrolls or verifies, and the request is retried with a user key that records the MFA. The React SDK does this automatically. With a server SDK, see authorizing actions.
A completed verification lasts for your app’s MFA cache duration, 15 minutes by default. Inside that window, the user can take more actions that require MFA without verifying again. After it, their user key still authorizes everything that doesn’t require MFA.
MFA applies only to users. An authorization key satisfies an ALLOW_WITH_MFA rule without MFA. If an authorization key can authorize a request on its own, such as a key added as a signer, the rule adds no MFA requirement to that request.