---
title: "Multi-Factor Authentication (MFA)"
slug: "multi-factor-authentication-mfa"
tags: ["administration", "authentication", "guides"]
updated: 2026-09-11T19:13:56Z
published: 2026-09-15T20:08:17Z
canonical: "docs.unqork.io/multi-factor-authentication-mfa"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.unqork.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Multi-Factor Authentication (MFA)

Multi-factor authentication (MFA) requires users to verify their identity using a secondary method after entering their credentials. Unqork supports MFA for both Creator and Express user accounts. MFA applies only to local Unqork accounts. SSO users authenticate through their identity provider, which manages MFA independently.

> [!WARNING]
> MFA is a global environment setting. It cannot be enabled for individual accounts or roles, and it cannot be enabled for Creator accounts independently of Express accounts.

## Before You Begin

If your environment uses **Text (SMS)** or **Phone Call** delivery, every user account must have a valid phone number before MFA can be enabled. Any account without a phone number receives an error when attempting to log in after MFA is enabled.

> [!NOTE]
> The phone number requirement applies only to Text (SMS) and Phone Call delivery. Email delivery does not require a phone number on the user's account.

To verify that users have phone numbers on their accounts, export a user list from [Creator (User) Administration](/unqorkai/docs/creator-user-administration) or [Express User Administration](/unqorkai/docs/express-user-administration).

**Export Creator user accounts**:

1. In the UnqorkAI platform, select **Administration** from the navigation menu.
2. Select **Creator (User) Administration**.
3. At the top right of the page, click **Export All Creators**. A CSV file containing Creator accounts and their associated data downloads to your machine.
4. Open the file and confirm that all accounts include a valid phone number.

**Export Express user accounts**:

1. In the UnqorkAI platform, select **Administration** from the navigation menu.
2. Select **Express User Administration**.
3. At the bottom of the page, click **Export All Express Users**. A CSV file containing Express user accounts and their associated data downloads to your machine.
4. Open the file and confirm that all accounts include a valid phone number.

If any accounts are missing phone numbers and your environment uses Text (SMS) or Phone Call delivery, add them before requesting MFA activation.

**Add phone numbers to Creator accounts**:

Creator accounts do not support bulk import. Update each account individually in [Creator (User) Administration](/unqorkai/docs/creator-user-administration).

**Add phone numbers to Express user accounts**:

Express User Administration supports bulk import. Add a `phone` column to the exported CSV and populate the missing phone numbers. Re-upload the file using the **Upload Users File** option in [Express User Administration](/unqorkai/docs/express-user-administration).

## Request MFA Activation

After verifying that all user accounts meet the delivery method requirements, submit a support ticket to request MFA activation for your environment.

1. Go to [Unqork Support](http://support.unqork.com/) and log in.
2. Click **Submit a Request**.
3. In the **Subject** field, enter a description. For example: `Enable MFA for Environment: training.unqork.io`.
4. From the **Request Type** drop-down, select **Issue**.
5. From the **Issue Type** drop-down, select **Environment Management**.
6. From the **Task Topic** drop-down, select **Other**.
7. In the **Description** field, include the environment name and URL where MFA should be enabled. For example: `Please enable MFA for the following environments: training.unqork.io, training-staging.unqork.io`.
8. Click **Submit**.

Unqork Support contacts you with further directions after receiving the request.

![The Unqork Support Submit a Request form filled out with Issue Type set to Environment Management, Task Topic set to Other, and example environment URLs in the Subject and Description fields.](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/api_upload_20260911_191356_19bf2b1580f44ee2bf4061e5e588a7a1.jpg?sv=2026-02-06&spr=https&st=2026-11-08T18%3A00%3A59Z&se=2026-11-08T19%3A00%3A59Z&sr=c&sp=r&sig=2snsVHBL99Q4DfmmjqaUYPm3jpIBB8Pf51%2Bu70HuFyg%3D)

## How MFA Works

After MFA is enabled, the login process changes for all local Unqork accounts in the environment.

**Login flow**:

1. The end-user enters their email address and password on the Unqork login screen.
2. A **Verify it's you** screen displays the delivery methods enabled for the environment. The end-user selects a method and clicks **Send Code**. This screen is always shown, even when only one delivery method is enabled.
3. A verification code is sent to the end-user. Codes are six digits and expire after 10 minutes. After three failed attempts, the code is invalidated and the end-user must request a new one.
4. A code entry screen displays. The end-user enters the code and clicks **Verify and Login** to complete login. If the code does not arrive, the end-user can click **Resend Code**.

  

![The Verify it's you screen showing three delivery method options: Text code, Call with code, and E-mail code, with a Send Code button.](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/api_upload_20260911_191356_0a65804c7d7c4f04bd847bb0a01f0b7a.png?sv=2026-02-06&spr=https&st=2026-11-08T18%3A00%3A59Z&se=2026-11-08T19%3A00%3A59Z&sr=c&sp=r&sig=2snsVHBL99Q4DfmmjqaUYPm3jpIBB8Pf51%2Bu70HuFyg%3D) ![The code entry screen showing a Validation code field, a Verify and Login button, and a Resend Code link.](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/api_upload_20260911_191356_ad828ab0a98c490f92eca9d6f14bab0f.png?sv=2026-02-06&spr=https&st=2026-11-08T18%3A00%3A59Z&se=2026-11-08T19%3A00%3A59Z&sr=c&sp=r&sig=2snsVHBL99Q4DfmmjqaUYPm3jpIBB8Pf51%2Bu70HuFyg%3D)

Unqork supports the following MFA delivery methods:

| Delivery Method | Description |
| --- | --- |
| **Text (SMS)** | A verification code is sent to the phone number on the end-user's account. |
| **Phone Call** | A verification code is delivered by automated phone call to the number on the end-user's account. |
| **Email** | A verification code is sent to the email address on the end-user's account. No phone number is required for email delivery. |

### Email Verification Details

When Email is the selected delivery method, Unqork sends a message with the following format:

| Field | Value |
| --- | --- |
| **From** | Unqork <[noreply@unqork.io](mailto:noreply@unqork.io)> |
| **Subject** | Verification Code |
| **Body** | The verification code is: `[6-digit code]` |

The email address shown on the delivery method selection screen is partially obfuscated for security. For example, `testuser@example.com` displays as `t*****r@e*****`.

## Frequently Asked Questions

**Can MFA be enabled for Creator and Express accounts independently?**

No. Enabling MFA applies it to all local accounts in the environment, both Creator and Express.

**Can I use both SSO and Unqork's MFA in the same environment?**

Yes. A mix of local Unqork accounts and SSO accounts is supported in the same environment. For example, internal users might authenticate through SSO, where the identity provider handles MFA. External users set up as local Unqork accounts use Unqork's built-in MFA.

**Does Unqork's MFA work for SSO users?**

No. SSO users authenticate through their identity provider. The identity provider is responsible for MFA for those accounts.

**Can the MFA login page be styled?**

Only the Express login page can be styled. Submit a support ticket to [Unqork Support](http://support.unqork.com/) to request a styled Express login page.

**Can I use a custom Express login page with MFA?**

No. Custom Express login pages are not compatible with MFA.

**What does the MFA verification email look like?**

See [Email Verification Details](/unqorkai/docs/multi-factor-authentication-mfa#email-verification-details) above for the default subject and body. Custom email templates are not currently supported.

## Limitations

- MFA cannot be enabled independently for Creator and Express accounts. Enabling MFA applies it to both.
- MFA cannot be enabled on a per-user or per-role basis.
- Custom Express login pages are not compatible with MFA.
- MFA does not apply to SSO users. For SSO accounts, the identity provider handles MFA.

---

**Changelog**

| Date | Change |
| --- | --- |
| 2026-07-24 | Added login flow, email verification details (sourced from codebase), and FAQ section sourced from v1 (EN-7972). |
| 2026-05-14 | Updated email MFA delivery — phone number no longer required; removed Authy references (UN-29675). |
| 2026-05-04 | Initial publication. |

Multi-factor authentication (MFA) is a security measure that requires users to provide multiple pieces of verification to access an account. Adding an extra layer of protection to prevent unauthorized access even if one credential is compromised. MFA is also known as two-step verification.

Also known as Unqork Users, or Designer Users; is anyone who is inside the Unqork platform.

The Unqork front-end application framework that delivers Creator-built applications to end-users. Express is the layer end-users interact with—the published forms, screens, and navigation built in the Module Builder. Express is distinct from Express View, which is a Creator-facing preview tool in the IDE.

Single Sign-On is an authentication scheme that enables users to use one set of login credentials across multiple services.

Identity provider (IdP) provide a service that creates, manages, and verifies users' digital identities, allowing them to securely authenticate and access different applications or services.

Also known as Unqork Users, or Designer Users; is anyone who is inside the Unqork platform.

A URL (uniform resource locator) is a unique identifier used to locate a resource on the internet. Also known as a web address.

End-users, also known as Express Users, are the individuals accessing an application through Express View. In most cases, end-users are the customers using the product.

End-users, also known as Express Users, are the individuals accessing an application through Express View. In most cases, end-users are the customers using the product.