> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fincept.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Multi-Factor Authentication

> Set up and manage MFA for enhanced account security

# Multi-Factor Authentication (MFA)

Add an extra layer of security to your Fincept account with email-based multi-factor authentication.

## What is MFA?

MFA requires **two forms of verification** to access your account:

1. **Something you know** - Your password
2. **Something you have** - OTP code sent to your email

This prevents unauthorized access even if your password is compromised.

## When to Use MFA

<CardGroup cols={2}>
  <Card title="Recommended For" icon="check">
    * Production API keys
    * High credit balance accounts
    * Enterprise users
    * Shared team accounts
    * Sensitive applications
  </Card>

  <Card title="Optional For" icon="circle">
    * Personal testing accounts
    * Development environments
    * Low-usage accounts
    * Guest accounts (not supported)
  </Card>
</CardGroup>

## Enabling MFA

### Prerequisites

* Verified email address
* Active registered account
* Valid API key

### Enable MFA

```bash theme={null}
curl -X POST https://api.fincept.in/user/mfa/enable \
  -H "X-API-Key: fk_user_your_key" \
  -H "Content-Type: application/json"
```

**Response:**

```json theme={null}
{
  "success": true,
  "data": {
    "message": "MFA enabled successfully. You will receive a verification code via email on your next login."
  }
}
```

<Info>
  MFA takes effect immediately. Your next login will require an OTP code.
</Info>

## Logging In with MFA

### Two-Step Login Process

**Step 1: Enter credentials**

```bash theme={null}
curl -X POST https://api.fincept.in/user/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "john@example.com",
    "password": "SecurePass123!"
  }'
```

**Response:**

```json theme={null}
{
  "success": true,
  "data": {
    "mfa_required": true,
    "message": "MFA code sent to your email. Please verify to complete login."
  }
}
```

**Step 2: Enter OTP code**

Check your email for 6-digit code, then:

```bash theme={null}
curl -X POST https://api.fincept.in/user/verify-mfa \
  -H "Content-Type: application/json" \
  -d '{
    "email": "john@example.com",
    "otp": "654321"
  }'
```

**Response:**

```json theme={null}
{
  "success": true,
  "data": {
    "api_key": "fk_user_your_key",
    "message": "MFA verification successful. Login complete."
  }
}
```

### OTP Details

| Property | Value                             |
| -------- | --------------------------------- |
| Length   | 6 digits                          |
| Validity | 10 minutes                        |
| Delivery | Email                             |
| Attempts | 5 max                             |
| Resend   | Not supported (request new login) |

## Disabling MFA

Requires password confirmation for security:

```bash theme={null}
curl -X POST https://api.fincept.in/user/mfa/disable \
  -H "X-API-Key: fk_user_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "password": "SecurePass123!"
  }'
```

**Response:**

```json theme={null}
{
  "success": true,
  "message": "MFA disabled successfully"
}
```

<Warning>
  Disabling MFA reduces account security. Only disable if absolutely necessary.
</Warning>

## Troubleshooting

### OTP Code Not Received

**Check:**

1. Email spam/junk folder
2. Email address is correct in profile
3. Wait up to 2 minutes for delivery

**Solution:**

```bash theme={null}
# Request new login (generates new OTP)
curl -X POST https://api.fincept.in/user/login \
  -H "Content-Type: application/json" \
  -d '{"email": "john@example.com", "password": "SecurePass123!"}'
```

### OTP Code Expired

```json theme={null}
{
  "success": false,
  "message": "MFA code expired"
}
```

**Solution:** Request new login - generates fresh OTP valid for 10 minutes.

### Too Many Failed Attempts

```json theme={null}
{
  "success": false,
  "message": "Too many MFA attempts"
}
```

**Solution:** Wait 10 minutes or request new login to reset attempt counter.

### Lost Access to Email

If you can't access your email to receive OTP:

1. Contact [support@fincept.in](mailto:support@fincept.in) from registered email
2. Provide account details for verification
3. Support will assist with email update or MFA reset

## Security Benefits

### Protection Against

<AccordionGroup>
  <Accordion title="Password Theft">
    Even if your password is stolen, attackers can't access your account without the OTP code sent to your email.
  </Accordion>

  <Accordion title="Phishing Attacks">
    Fake login pages can't intercept OTP codes sent to your email.
  </Accordion>

  <Accordion title="Brute Force">
    Multiple failed OTP attempts lock the session, preventing automated attacks.
  </Accordion>

  <Accordion title="Credential Stuffing">
    Stolen credentials from other breaches won't work without email access.
  </Accordion>
</AccordionGroup>

### Additional Security Layers

When MFA is enabled:

* Login attempts logged with IP address
* Failed OTP attempts tracked
* Email notification on successful login
* Session timeout after inactivity

## Best Practices

### Do's

* Enable MFA on production accounts
* Use strong, unique passwords
* Monitor login history regularly
* Keep email account secure
* Enable email 2FA as well

### Don'ts

* Don't share OTP codes
* Don't disable MFA without reason
* Don't use same password elsewhere
* Don't ignore suspicious login alerts

## Code Examples

### Python Login with MFA

```python theme={null}
import requests

def login_with_mfa(email, password):
    # Step 1: Login
    response = requests.post(
        "https://api.fincept.in/user/login",
        json={"email": email, "password": password}
    )

    data = response.json()

    if data["data"].get("mfa_required"):
        # Step 2: Get OTP from user
        otp = input("Enter OTP from email: ")

        # Step 3: Verify MFA
        mfa_response = requests.post(
            "https://api.fincept.in/user/verify-mfa",
            json={"email": email, "otp": otp}
        )

        return mfa_response.json()["data"]["api_key"]
    else:
        return data["data"]["api_key"]

api_key = login_with_mfa("john@example.com", "SecurePass123!")
```

### JavaScript Login with MFA

```javascript theme={null}
async function loginWithMFA(email, password) {
  // Step 1: Login
  const loginRes = await fetch(
    "https://api.fincept.in/user/login",
    {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ email, password })
    }
  );

  const loginData = await loginRes.json();

  if (loginData.data.mfa_required) {
    // Step 2: Get OTP from user
    const otp = prompt("Enter OTP from email:");

    // Step 3: Verify MFA
    const mfaRes = await fetch(
      "https://api.fincept.in/user/verify-mfa",
      {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ email, otp })
      }
    );

    const mfaData = await mfaRes.json();
    return mfaData.data.api_key;
  }

  return loginData.data.api_key;
}
```

## FAQs

<AccordionGroup>
  <Accordion title="Is MFA required?">
    No, MFA is optional but highly recommended for production accounts and enterprise users.
  </Accordion>

  <Accordion title="Can I use authenticator apps instead of email?">
    Currently only email-based OTP is supported. Authenticator app support is planned.
  </Accordion>

  <Accordion title="What if I change my email?">
    Update your email in profile settings. MFA will automatically use the new email.
  </Accordion>

  <Accordion title="Can I disable MFA temporarily?">
    Yes, but you'll need to re-enable it manually. We recommend keeping it enabled.
  </Accordion>

  <Accordion title="Does MFA work with API keys?">
    MFA only applies to login. Once you have your API key, use it directly without MFA for API requests.
  </Accordion>
</AccordionGroup>

## Next Steps

<CardGroup cols={2}>
  <Card title="Security Best Practices" icon="lock" href="/security-best-practices">
    Learn comprehensive security guidelines
  </Card>

  <Card title="API Keys Guide" icon="key" href="/api-keys">
    Complete API key management guide
  </Card>

  <Card title="Login History" icon="clock" href="/authentication#view-login-history">
    Monitor account activity
  </Card>

  <Card title="Account Settings" icon="gear" href="/authentication#managing-your-account">
    Manage your profile and preferences
  </Card>
</CardGroup>

Need help? Contact **[support@fincept.in](mailto:support@fincept.in)**