---
title: How to use Multifactor Authentication (MFA)
description: Enable and use Two-Factor Authentication (2FA) in Scaleway.
tags: authentication 2FA two-factor two multifactor security google authenticator
dates:
validation: 2025-03-24
posted: 2022-01-14
---
import Requirements from '@macros/iam/requirements.mdx'
Multifactor authentication (MFA) adds extra layers of security to your Scaleway account. Beyond your password, MFA requires one or more additional verification factors to grant access — meaning your account stays protected even if your password is compromised.
Two MFA methods are available:
- **One-time password (TOTP)** - a unique, time-based code generated by an authenticator app.
- **Passkey** - a passwordless authentication method that removes the need to create, manage, or remember passwords.
As an account Owner, you can enable both MFA methods simultaneously. We recommend keeping at least one method active at all times to maintain account security.
- A Scaleway account logged in to the [console](https://console.scaleway.com)
## Enable TOTP
To use TOTP on your account, you first need to install an authenticator app on your phone. Once set up, the TOTP app generates a rotating set of time-based codes used to verify your identity at login. Popular TOTP apps include:
- [Authy](https://authy.com/download/)
- [FreeOTP](https://freeotp.github.io/)
- [Google Authenticator](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en&gl=US)
1. Download and install an app of your choice on your phone.
2. Go to your [Account Security](https://console.scaleway.com/settings/account/security) page.
If you are logged in as an [IAM Member](/iam/concepts/#member), click **Credentials** in your user overview page.
3. Click **Set up TOTP** in the **Multifactor authentication** section. A pop-up displays.
4. Scan the QR code or enter the code shown into your authenticator app.
Your app sets up MFA for your Scaleway account and displays a 6-digit code.
5. Enter the 6-digit code into the box and click **Submit**.
6. Download or copy the backup codes displayed, and store them somewhere safe. These are the only way to recover access to your account if you lose your TOTP app.
TOTP MFA is now enabled on your account.
From your next login onwards, you will be prompted to enter a TOTP code from your authenticator app.
### Update TOTP
If you no longer have access to the device where TOTP was set up, you can reconfigure it through the Scaleway console.
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
- [Enabled TOTP](#how-to-enable-totp) on your account
If you have lost access to your account and cannot log in, refer to the [Cannot log in to my account](/account/troubleshooting/cannot-log-into-my-account/) troubleshooting procedure.
1. Go to your [Account Security](https://console.scaleway.com/settings/account/security) page.
2. Click **Update TOTP** in the Multifactor authentication section. A pop-up displays.
3. Scan the QR code or enter the code shown into your authenticator app.
Your app sets up TOTP for your Scaleway account and displays a 6-digit code.
4. Enter the 6-digit code into the box and click **Submit**.
5. Download or copy the new backup codes and store them somewhere safe.
### Delete TOTP
1. Go to your [Account Security](https://console.scaleway.com/settings/account/security) page.
2. Click **Delete TOTP** in the Multifactor authentication section. A pop-up displays.
3. Type **DELETE** in the box to confirm and click **Delete TOTP**.
TOTP is now disabled on your account.
If you are a Member of an Organization that enforces MFA, you must re-enable TOTP before the Organization's [grace period](/iam/how-to/comply-with-sec-requirements-member/#grace-period) ends, otherwise your Member account will be locked.
## Enable a passkey
A passkey is a passwordless authentication method based on public-key cryptography, supported by the WebAuthn standard.
When you create a passkey, your authenticator app generates a key pair: the private key stays on your device, while the public key is sent to Scaleway.
At login, Scaleway issues a challenge that your device signs with the private key — Scaleway then verifies it using the public key.
Passkeys are currently only available for account Owners, not IAM Members.
- [Owner](/iam/concepts/#owner) status
- Set up a [password manager](/account/concepts/#password-manager) on your device
1. Go to your [Account Security](https://console.scaleway.com/settings/account/security) page.
2. Click **+ Add passkey** in the Multifactor authentication section. A pop-up displays.
3. Enter the passkey name you configured in your password manager.
4. Click **Start**. Your password manager will be prompted and a pop-up may appear in your browser.
5. Follow your password manager's instructions to complete the setup.
A confirmation message displays once the passkey is successfully added.
6. Click **Close**.
Your passkeys are now listed in the Multifactor authentication section.
### Delete a passkey
1. Go to your [Account Security](https://console.scaleway.com/settings/account/security) page.
2. Click next to the passkey you want to delete in the Multifactor authentication section. A pop-up displays.
3. Type **DELETE** in the box to confirm and click **Delete passkey**.
The passkey is removed from your Scaleway account.
Deleting a passkey here only removes it from Scaleway. You may also need to delete it manually from your password manager or authenticator service.
## Troubleshoot TOTP login issues
If you have problems logging in to the console with TOTP, refer to the [dedicated troubleshooting page](/account/troubleshooting/cannot-log-into-my-account/#i-have-lost-my-totp-mfa-device).