---
title: Use Multifactor Authentication (MFA)
description: Enable and use Two-Factor Authentication (2FA) in Scaleway.
tags: authentication 2FA two-factor two multifactor security google authenticator
dates:
validation: 2026-06-26
posted: 2022-01-14
---
import Requirements from '@macros/iam/requirements.mdx'
Multifactor authentication (MFA) adds a second verification step when you log in to the Scaleway console. Even if someone obtains your password, they cannot access your account without this second factor.
Scaleway supports two MFA methods:
- **One-time password (TOTP)** - a unique, time-based code generated by an authenticator app on your phone. Available to all account types (Owners and IAM Members).
- **Passkey** - a passwordless method based on public-key cryptography (WebAuthn standard). Passkeys can act as a second factor, or — if your device supports user verification — as a complete single-step login that handles both factors at once. Available to account Owners only.
As an account Owner, you can enable both methods simultaneously.
- A Scaleway account logged in to the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/glossary/#owner) status or [IAM permissions](/iam/concepts/glossary/#permission) allowing you to perform actions in the intended Organization
## TOTP authentication
To use TOTP, you first need to install an authenticator app on your device. Once set up, the app generates rotating codes used to verify your identity at login. Popular TOTP apps include [Google Authenticator](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en&gl=US), [Authy](https://authy.com/download/), and [FreeOTP](https://freeotp.github.io/).
### Enable TOTP
1. Download and install an app of your choice on your device.
2. Go to your [Account Security](https://console.scaleway.com/settings/account/security) page.
If you are logged in as an [IAM Member](/iam/concepts/glossary/#member), click **Credentials** in your user overview page.
3. In the **Authentication methods** section, click **Set up TOTP**. A pop-up appears.
4. Scan the QR code with your authenticator app, or manually enter the setup code shown if you cannot scan it. Your app will begin generating 6-digit codes for your Scaleway account.
5. Enter the current 6-digit code from your app into the box and click **Submit**.
6. Download or copy the backup codes displayed, and store them somewhere safe.
Your backup codes are the only way to recover access to your account if you lose your phone or authenticator app. Each code can only be used once. Store them securely — for example in a password manager.
TOTP MFA is now enabled on your account. From your next login onward, you will be prompted to enter a 6-digit code from your authenticator app after your primary credentials.
### Update TOTP
If you no longer have access to the device where TOTP was set up, you can reconfigure it through the Scaleway console.
1. Go to your [Account Security](https://console.scaleway.com/settings/account/security) page.
2. In the **Authentication methods** section, click **Set up TOTP**. A pop-up appears.
3. Scan the QR code with your authenticator app, or manually enter the setup code shown if you cannot scan it. Your app will begin generating 6-digit codes for your Scaleway account.
4. Enter the current 6-digit code from your app into the box and click **Submit**.
5. Download or copy the backup codes displayed, and store them somewhere safe.
If you have lost access to your account and cannot log in, see [I cannot log in to my account](/account/troubleshooting/cannot-log-into-my-account/).
### Delete TOTP
1. Go to your [Account Security](https://console.scaleway.com/settings/account/security) page.
2. In the **Authentication methods** section, click **Delete**. A pop-up appears.
3. Type **DELETE** in the box to confirm, and click **Delete TOTP**.
TOTP is now disabled on your account.
If you are a Member of an Organization that enforces MFA, you must re-enable TOTP before the Organization's [grace period](/iam/security/comply-with-sec-requirements-member/#grace-period) ends, otherwise your Member account will be locked.
## Passkey authentication
A passkey is a passwordless authentication method based on public-key cryptography, supported by the WebAuthn standard.
When you create a passkey, your authenticator app generates a key pair: the private key stays on your device, while the public key is sent to Scaleway.
At login, Scaleway issues a challenge that your device signs with the private key — Scaleway then verifies it using the public key.
Passkeys are currently only available for account Owners, not IAM Members.
You can use a passkey in two ways:
- As a passwordless login method: if your passkey supports user verification, it handles both factors in a single gesture, no password required. User verification means your device confirms that you are the authorized owner before releasing the passkey, typically via a biometric check (fingerprint, Face ID) or a PIN. For example, a macOS passkey protected by Touch ID supports identity verification.
- As a two-factor login method (2FA): if your passkey does not support user verification, it acts as a WebAuthn security key — confirming possession of the device after a first factor (password, SSO, or authentication code).
Not all passkeys support user verification. If you authenticate with your passkey and are returned to the login form instead of being signed in, see [I cannot use my passkey as a passwordless login](/account/troubleshooting/cannot-use-passkey/).
- [Owner](/iam/concepts/glossary/#owner) status
- Set up a [password manager](/account/concepts/glossary/#password-manager) on your device
### Enable a passkey
1. Go to your [Account Security](https://console.scaleway.com/settings/account/security) page.
2. In the **Authentication methods** section, click **+ Add passkey**. A pop-up opens.
3. Enter the passkey name you configured in your password manager.
4. Click **Start**. Your password manager will be prompted, and a pop-up may appear in your browser.
5. Follow your password manager's instructions to complete the setup.
A message confirms the passkey is successfully added.
6. Click **Close**.
### Upgrade a passkey to passwordless login
1. Go to your [Account Security](https://console.scaleway.com/settings/account/security) page.
2. Next to the passkey you want to upgrade, click > **Upgrade to passwordless login**. A pop-up appears.
3. Click **Upgrade to passwordless login**. Your password manager will be prompted, and a pop-up may appear in your browser to check identity verification.
4. Follow your password manager's instructions to complete the setup. A confirmation message displays once the passkey is upgraded.
5. Click **Close**.
If the upgrade fails, see [I cannot use my passkey as a passwordless login](/account/troubleshooting/cannot-use-passkey/).
### Delete a passkey
1. Go to your [Account Security](https://console.scaleway.com/settings/account/security) page.
2. Next to the passkey you want to delete, click > **Delete**. A pop-up appears.
3. Type **DELETE** in the box to confirm and click **Delete passkey**.
The passkey is removed from your Scaleway account.
Deleting a passkey here only removes it from Scaleway. You may also need to delete it manually from your password manager or authenticator service.
## Troubleshoot login issues
If you have problems logging in to the console with TOTP, see [I cannot log in to my account](/account/troubleshooting/cannot-log-into-my-account/#i-have-lost-my-totp-mfa-device).
If you have problems logging in to the console with a passkey, see [I cannot use my passkey as a passwordless login](/account/troubleshooting/cannot-use-passkey/).