Identity & access
Setting up TOTP MFA, and where security keys stand
TOTP enrolment and backup codes are complete and are the factor to rely on today. Security-key enrolment exists too, and this guide is explicit about the part of it that is not finished rather than implying parity.
Open Enrol a second factor in the consoleTOTP and backup codes
- Enrol TOTPEnrol an authenticator app and confirm it with a generated code. This is the factor to rely on today.
- Save the backup codesStore the backup codes somewhere that does not depend on the device holding the authenticator. They are the recovery path if that device is lost.
Failed sign-in attempts are throttled: five failures inside a fifteen-minute window locks the account. This is account-level lockout rather than a general request limiter, so it protects the password even where no second factor is enrolled.
Where security keys stand
Lockout, and why it is separate
Five failed sign-in attempts inside a fifteen-minute window lock the account. This is account-level lockout keyed to the account itself, not a general request-rate limit — so it protects the password even where no second factor is enrolled.
- Threshold
- 5 attemptsFailed, within the window
- Window
- 15 minutesRolling
- Scope
- The accountNot an IP rate limit
Recovering without the device
Backup codes are the recovery path, which is why they should be stored somewhere that does not depend on the device holding the authenticator. A phone that holds both the authenticator and the only copy of the codes is a single point of failure wearing a belt and braces.
Put it into practice
Run a fleet with these guardrails on from day one.
Hard cost caps, one audited gateway in front of every tool call, and versioned rule files — the defaults, not an enterprise add-on.