Skip to content
DeviceQuest DeviceQuest DeviceQuest Docs User Documentation

Documentation

Multi-Factor Authentication

Protect your account with an authenticator app, sign in with a one-time code, and manage your backup codes.

Overview

Multi-factor authentication (MFA) adds a second step to signing in: after your password, you enter a 6-digit code from an authenticator app on your phone, such as Google Authenticator, Authy or 1Password. Your account then stays protected even if someone learns your password.

You manage your own MFA on the Multi-Factor Authentication page at /profile/mfa. Open it from your account menu at the bottom of the sidebar: click your name, then MFA Settings. Every signed-in user can manage their own MFA; no permission is needed. Your administrator can also make MFA mandatory for a role. Members of that role must set it up during their next sign-in.

Sign in with a code

When MFA is on for your account, DeviceQuest asks for a code right after your password.

  1. VERIFICATION CODE: the 6-digit code your authenticator app shows for DeviceQuest. The field accepts digits.
  2. Use a backup code instead: switches the field to BACKUP CODE, for when your phone is out of reach. Click Use authenticator app instead to switch back.
  3. Verify: checks the code and signs you in. The button becomes available once the code is complete.
  4. Use a different account: returns to the sign-in page.
  1. Sign in with your email and password. The Enter your code screen opens, marked VERIFICATION REQUIRED.
  2. Open your authenticator app and find the DeviceQuest entry.
  3. Type the 6-digit code into VERIFICATION CODE. Your browser or password manager may fill it in for you.
  4. Click Verify. DeviceQuest opens Asset Inventory.

Use a backup code

  1. On Enter your code, click Use a backup code instead.
  2. Type one of the backup codes you saved when you set up MFA. Codes look like 1A2B-3C4D; you can type or paste them with or without the dash, in upper or lower case.
  3. Click Verify.

Each backup code works once. After you use one, check how many you have left on the MFA page and regenerate them when they run low.

You have 5 minutes to enter the code after your password. After that, DeviceQuest shows No active MFA challenge. Please sign in again. with a Back to sign in link.

Code messages

MessageMeaningWhat to do
Invalid code. Try again.The authenticator code is wrong or has already rolled over.Wait for the next code in your app and type it. Check that your phone’s clock is set automatically.
That backup code is not valid or has already been used.The backup code is wrong or used up.Try another backup code.
Too many attempts. Wait 15 minutes and sign in again.Code entry is locked after 10 wrong codes within 5 minutes.Wait 15 minutes, then sign in again.
Something went wrong on our end. Please try again in a moment.DeviceQuest had an internal error.Try again in a moment.
Could not reach the server. Check your connection and try again.The connection between your browser and DeviceQuest dropped.Check your connection and try again.

Set up MFA when your role requires it

If your administrator requires MFA for your role and you haven’t set it up yet, DeviceQuest asks you to do it during sign-in. DeviceQuest opens as soon as setup is finished. The admin role created during first-run setup always requires MFA.

  1. Start MFA setup: creates your authenticator secret and shows the QR code.
  2. Use a different account: returns to the sign-in page.
  1. Sign in with your email and password. Set up multi-factor authentication opens, marked SETUP REQUIRED, with the note Your role requires MFA. Set it up now to complete sign-in.
  2. Click Start MFA setup.
  3. Scan the QR code with your authenticator app, or click Copy secret and add the secret to the app by hand.
  4. Type the 6-digit code the app now shows, and click Verify and continue.
  5. Your 10 backup codes appear. Save them with Copy all or Download .txt (see Save your backup codes).
  6. Tick I have saved these backup codes in a safe place and click Done. DeviceQuest opens Asset Inventory.

You have 5 minutes from your password to finish setup. If the time runs out, DeviceQuest shows No active MFA enrollment. Please sign in again. with Back to sign in. Sign in again to restart setup.

The Multi-Factor Authentication page

The page shows where your account stands, the evidence of recent verifications, and your recovery codes. It looks different before and after you enable MFA.

Before you enable MFA

  1. Status bar: Password-only and No second factor is enrolled. Add one so a stolen password is not enough to sign in.
  2. Enable MFA: opens the setup wizard. Below it, the page lists what you get: offline codes from any standard authenticator app, and 10 single-use backup codes you can store offline.
  3. Keyboard hint: shows the shortcut for this state, e to enroll.

Under Your account is password-only, Proof Trail is empty until you enable MFA and verify your first code.

After you enable MFA

Once MFA is on, the page shows these parts, from top to bottom:

  • Status bar: Protection active with the method TOTP authenticator, and Each sign-in requires a one-time code · enrolled time ago. On the right:
    • Last verified: when you last entered a code, for example 2 hours ago. Click it to open the side sheet on the Audit tab.
    • Recovery codes: for example 8 backup codes left, coloured by health. Click it to open the side sheet on the Recovery tab.
  • Proof Trail: Verification activity · last 14 days (UTC).
    • A bar chart with one bar per day, from 14 days ago to Today. Hover over a bar to see the date and the number of verifications.
    • A summary such as 12 verifications across 5 days.
    • Your four most recent MFA events, each with its time (UTC) and IP address: MFA enabled, Verified with authenticator, Authenticator verification failed, MFA disabled or MFA reset by administrator.
    • Full audit log → opens the audit log filtered to your account.
  • Authenticator (Enrolled on this account): a card for Authenticator app, Time-based one-time passwords, with a TOTP badge and the number of backup codes left. Click the card to open the side sheet on the Overview tab.
  • Recovery codes (One-time fallback if you lose your authenticator): a health badge, 8 of 10 codes remaining, and two actions:
    • Regenerate backup codes: opens the regenerate dialog.
    • View recovery details: opens the side sheet on the Recovery tab.
  • Keyboard hint: e enroll · d disable · r regenerate · g then o/r/a for panels.

After an action, a short notice appears at the top of the page for a few seconds:

  • MFA enabled. Store your backup codes somewhere safe.
  • MFA disabled. Your account is password-only again.
  • New backup codes generated. Previous codes no longer work.

Recovery codes

DeviceQuest gives you 10 backup codes when you enable MFA. Each works once, in place of an authenticator code. The page rates how many you have left:

BadgeCodes leftWhat it means
Healthy7–10You have plenty of codes.
Running low3–6Plan to regenerate soon.
Critical0–2Regenerate now, or you could be locked out if you lose your phone.

Enable MFA

The Enable MFA wizard has three steps: Scan, Verify and Backup codes.

Step 1: Scan

  1. Step strip: shows where you are. Finished steps get a check mark.
  2. QR code: scan it with your authenticator app (Google Authenticator, Authy, 1Password, and similar apps).
  3. Or enter this secret manually:: the same secret as text, for apps or devices without a camera.
  4. Copy secret: copies the secret. The button briefly shows ✓ Copied.
  5. Continue →: goes to the Verify step. I’ll scan later also moves on, so you can type the secret into your app before verifying.
  1. On the Multi-Factor Authentication page, click Enable MFA, or press e. The Enable MFA dialog opens and shows Starting enrollment… for a moment.
  2. In your authenticator app, add a new account and scan the QR code. To add it by hand, click Copy secret and paste the secret into the app. The app lists the entry as DeviceQuest with your email.
  3. Click Continue →.

Step 2: Verify

  1. Verification code: six boxes, one per digit. Typing a digit moves to the next box; Backspace in an empty box moves back; pasting a code fills all six.
  2. ← Back: returns to Scan to see the QR code again.
  3. Verify and continue: checks the code. The button becomes available once all six digits are filled in.
  1. Type the 6-digit code your app shows for DeviceQuest.
  2. Click Verify and continue. If the code is wrong, DeviceQuest shows That code didn’t match. Try the next one your app generates. Wait for the next code and try again.

Step 3: Backup codes

Your MFA is now active, and DeviceQuest shows your 10 backup codes:

  • A red notice: Save these now. They won’t be shown again. Each code can be used once.
  • The codes, in a grid.
  • Copy all: copies all codes, one per line. The button briefly shows ✓ Copied.
  • Download .txt: downloads the codes as devicequest-backup-codes.txt.
  • I have saved these backup codes in a safe place: tick this to enable Done.
  1. Save the codes somewhere safe and separate from your phone, for example in your password manager or printed in a locked drawer.
  2. Tick I have saved these backup codes in a safe place.
  3. Click Done. The page shows MFA enabled. Store your backup codes somewhere safe.

The authenticator side sheet

Click the Authenticator app card (or Last verified, Recovery codes or View recovery details) to open Authenticator details from the right. The top of the sheet repeats Authenticator app (TOTP) with the badges TOTP, Active and the backup-code count, plus Open full page ↗, which opens the same details at /profile/mfa/totp. Close the sheet with ✕, a click outside it, or Esc.

The sheet has three tabs:

TabWhat it shows
OverviewMethod (Authenticator app (TOTP)), Status (Active), Enrolled and Last verified (relative times; hover for the exact UTC time), Backup codes (n remaining), Issuer (DeviceQuest), Account (your email) and Account ID with Copy ID. At the bottom, Disable MFA with the note Disabling MFA removes your second factor. You will need a TOTP code to confirm.
RecoveryThe number of backup codes left with a health badge, of 10 total, Regenerate backup codes, and a reminder that Codes are shown only once.
AuditUp to 25 MFA events from the last 90 days, each with its time (UTC) and IP address, and Open full audit log for this account →. When there are none: No MFA events in the last 90 days.

The sheet’s URL records the open tab (for example /profile/mfa?id=totp&panel=recovery), so you can bookmark or share a direct link to it. The full page at /profile/mfa/totp has the same three tabs and a ← Back to MFA link.

Regenerate backup codes

Regenerate when you’ve used most of your codes or think someone else has seen them.

  1. Click Regenerate backup codes (on the page or on the Recovery tab), or press r.
  2. The Regenerate backup codes dialog warns: Existing codes will become invalid immediately. Enter your current TOTP code to generate a fresh set of 10 codes.
  3. Type the 6-digit code from your authenticator app into Verification code.
  4. Click Regenerate codes. The button reads Generating… while it works.
  5. New backup codes appear. Save them as in Step 3, tick the confirmation and click Done.

Your old codes stop working at once. The page shows New backup codes generated. Previous codes no longer work.

Disable MFA

  1. Open the side sheet and click Disable MFA on the Overview tab, or press d on the MFA page.
  2. The Disable MFA dialog warns: This will remove your second factor. You will only need your password to sign in.
  3. Type your current 6-digit code into Verification code.
  4. Click Yes, disable MFA. The button reads Disabling… while it works.

The page returns to Password-only and shows MFA disabled. Your account is password-only again. If your role requires MFA, DeviceQuest asks you to set it up again at your next sign-in.

MessageMeaning
Invalid code. Try again.The code didn’t match. Use the next code from your app.
MFA is not currently enabled.MFA was already off, for example because an administrator reset it.
MFA is already enabled.You started the wizard on an account that already has MFA.

If you lose your phone

  1. Sign in with your password, then click Use a backup code instead and enter one of your backup codes.
  2. Ask your administrator to reset your MFA. The reset appears in your Proof Trail as MFA reset by administrator.
  3. On the Multi-Factor Authentication page, click Enable MFA and set up the authenticator app on your new phone. You get a fresh set of 10 backup codes.

If you have no backup codes left, ask your administrator to reset your MFA first; you then sign in with your password, or set up MFA again during sign-in if your role requires it.

Keyboard shortcuts

These shortcuts work on the Multi-Factor Authentication page whenever the cursor is outside a text field.

KeyAction
eOpens the Enable MFA wizard (when MFA is off).
dOpens Disable MFA (when MFA is on).
rOpens Regenerate backup codes (when MFA is on).
g then oOpens the side sheet on the Overview tab.
g then rOpens the side sheet on the Recovery tab.
g then aOpens the side sheet on the Audit tab.
EscCloses the open dialog and the side sheet.
← / →, Home / EndMoves between the Overview, Recovery and Audit tabs when a tab has focus.

Press the second key of a g sequence within about half a second.