Skip to main content
With granular MFA, a user completes MFA for wallet actions that match an ALLOW_WITH_MFA rule, and for changes to resources they own.

​
Wallet actions

To authorize a request that matches an ALLOW_WITH_MFA rule in the wallet’s policies, the user must:
  1. Be enrolled in MFA. A user who hasn’t enrolled must enroll first.
  2. Have verified MFA within the cache duration.
Requests that match an ALLOW rule, and no DENY or ALLOW_WITH_MFA rule, go through without MFA, even for enrolled users, or else the request is denied by default.
  • If the user is a member of a key quorum, their signature counts toward the threshold only with MFA. When approving an intent, include the MFA token with the approval. Each member can approve an intent only once.
  • Authorization key signatures count toward the threshold without MFA.

​
Resource updates

Changing a resource a user owns requires that user’s MFA. Otherwise, a user could delete an ALLOW_WITH_MFA rule without MFA, then take the action it protected. This applies to resources owned by a user, or by a key quorum with user members: These changes don’t require MFA:
  • Creating a resource, such as a new wallet or policy.
  • Changing a resource without an owner. Your app’s credentials control these resources directly.
Exporting a private key or seed phrase is a wallet action, not a resource change. It requires MFA only if a policy rule for exportPrivateKey or exportSeedPhrase uses ALLOW_WITH_MFA. See granular MFA policies.