Request access
Granular MFA is available on Enterprise plans. Contact Privy to enable it for your app’s account.Enable transaction MFA
In the Privy Dashboard, enable transaction MFA and choose your app’s MFA methods. The cache duration sets how long a completed MFA verification lasts. See MFA setup.Create a policy
This policy requires MFA to export a wallet’s private key or seed phrase, and allows every other action. See granular MFA policies for more examples.Create policies on your app’s backend with a server SDK. Create the policy once, and store its ID to apply to each user’s wallet. With the NodeJS SDK:
Add the policy to a wallet
Attach the policy to each wallet it should protect. Setpolicy_ids when creating a wallet, or update an existing wallet.
Apply the policy to the user’s wallet with the With granular MFA on, changing a wallet’s policies requires the user’s MFA. The React SDK prompts for it starting in
updateWallet method from the useUpdateWallet hook. The React SDK signs the update with the user’s authorization signature.@privy-io/react-auth version 3.51.4.Once a wallet has the policy, the React SDK prompts the user to enroll or verify when an action requires MFA, then retries the request once. This covers useSignMessage, useSignTypedData, useSendTransaction, useSignTransaction, and the EIP-1193 provider, starting in version 3.51.1. It also covers the Solana signMessage, signTransaction, and signAndSendTransaction methods. Starting in version 3.51.4, it also covers useTransfer, useUpdateWallet, useSigners, useSignRawHash, swaps, and earn.If your app uses custom MFA UIs, register both onMfaRequired and onMfaEnrollmentRequired with useRegisterMfaListener. Without onMfaEnrollmentRequired, a request from an unenrolled user waits five minutes, then fails.Update to granular MFA
In the dashboard’s transaction MFA settings, select Update to granular MFA and confirm. Wallet actions that match noALLOW_WITH_MFA rule stop requiring MFA right away.

