Skip to main content
To set up granular MFA, enable transaction MFA, create a policy that requires MFA, add it to wallets, then update your app to granular MFA.

Request access

Granular MFA is available on Enterprise plans. Contact Privy to enable it for your app’s account.

Enable transaction MFA

In the Privy Dashboard, enable transaction MFA and choose your app’s MFA methods. The cache duration sets how long a completed MFA verification lasts. See MFA setup.

Create a policy

This policy requires MFA to export a wallet’s private key or seed phrase, and allows every other action. See granular MFA policies for more examples.
Create policies on your app’s backend with a server SDK. Create the policy once, and store its ID to apply to each user’s wallet. With the NodeJS SDK:

Add the policy to a wallet

Attach the policy to each wallet it should protect. Set policy_ids when creating a wallet, or update an existing wallet.
Apply the policy to the user’s wallet with the updateWallet method from the useUpdateWallet hook. The React SDK signs the update with the user’s authorization signature.
With granular MFA on, changing a wallet’s policies requires the user’s MFA. The React SDK prompts for it starting in @privy-io/react-auth version 3.51.4.Once a wallet has the policy, the React SDK prompts the user to enroll or verify when an action requires MFA, then retries the request once. This covers useSignMessage, useSignTypedData, useSendTransaction, useSignTransaction, and the EIP-1193 provider, starting in version 3.51.1. It also covers the Solana signMessage, signTransaction, and signAndSendTransaction methods. Starting in version 3.51.4, it also covers useTransfer, useUpdateWallet, useSigners, useSignRawHash, swaps, and earn.If your app uses custom MFA UIs, register both onMfaRequired and onMfaEnrollmentRequired with useRegisterMfaListener. Without onMfaEnrollmentRequired, a request from an unenrolled user waits five minutes, then fails.

Update to granular MFA

In the dashboard’s transaction MFA settings, select Update to granular MFA and confirm. Wallet actions that match no ALLOW_WITH_MFA rule stop requiring MFA right away.
Updating to granular MFA cannot be undone. Your app cannot switch back to standard transaction MFA or disable transaction MFA. The app’s MFA methods and cache duration carry over and stay editable.