Use Multifactor Authentication (MFA)

Reviewed on June 26, 2026

Multifactor authentication (MFA) adds a second verification step when you log in to the Scaleway console. Even if someone obtains your password, they cannot access your account without this second factor.

Scaleway supports two MFA methods:

• One-time password (TOTP) - a unique, time-based code generated by an authenticator app on your phone. Available to all account types (Owners and IAM Members).
• Passkey - a passwordless method based on public-key cryptography (WebAuthn standard). Passkeys can act as a second factor, or — if your device supports user verification — as a complete single-step login that handles both factors at once. Available to account Owners only.

As an account Owner, you can enable both methods simultaneously.

Before you start

To complete the actions presented below, you must have:

• A Scaleway account logged in to the console
• Owner status or IAM permissions allowing you to perform actions in the intended Organization

TOTP authentication

To use TOTP, you first need to install an authenticator app on your device. Once set up, the app generates rotating codes used to verify your identity at login. Popular TOTP apps include Google Authenticator, Authy, and FreeOTP.

Enable TOTP

1. Download and install an app of your choice on your device.
2. Go to your Account Security page. If you are logged in as an IAM Member, click Credentials in your user overview page.
3. In the Authentication methods section, click Set up TOTP. A pop-up appears.
4. Scan the QR code with your authenticator app, or manually enter the setup code shown if you cannot scan it. Your app will begin generating 6-digit codes for your Scaleway account.
5. Enter the current 6-digit code from your app into the box and click Submit.
6. Download or copy the backup codes displayed, and store them somewhere safe.
   Important

   Your backup codes are the only way to recover access to your account if you lose your phone or authenticator app. Each code can only be used once. Store them securely — for example in a password manager.

TOTP MFA is now enabled on your account. From your next login onward, you will be prompted to enter a 6-digit code from your authenticator app after your primary credentials.

Update TOTP

If you no longer have access to the device where TOTP was set up, you can reconfigure it through the Scaleway console.

1. Go to your Account Security page.
2. In the Authentication methods section, click Set up TOTP. A pop-up appears.
3. Scan the QR code with your authenticator app, or manually enter the setup code shown if you cannot scan it. Your app will begin generating 6-digit codes for your Scaleway account.
4. Enter the current 6-digit code from your app into the box and click Submit.
5. Download or copy the backup codes displayed, and store them somewhere safe.

If you have lost access to your account and cannot log in, see I cannot log in to my account.

Delete TOTP

1. Go to your Account Security page.
2. In the Authentication methods section, click Delete. A pop-up appears.
3. Type DELETE in the box to confirm, and click Delete TOTP.

TOTP is now disabled on your account.

Passkey authentication

A passkey is a passwordless authentication method based on public-key cryptography, supported by the WebAuthn standard.

When you create a passkey, your authenticator app generates a key pair: the private key stays on your device, while the public key is sent to Scaleway. At login, Scaleway issues a challenge that your device signs with the private key — Scaleway then verifies it using the public key.

You can use a passkey in two ways:

• As a passwordless login method: if your passkey supports user verification, it handles both factors in a single gesture, no password required. User verification means your device confirms that you are the authorized owner before releasing the passkey, typically via a biometric check (fingerprint, Face ID) or a PIN. For example, a macOS passkey protected by Touch ID supports identity verification.
• As a two-factor login method (2FA): if your passkey does not support user verification, it acts as a WebAuthn security key — confirming possession of the device after a first factor (password, SSO, or authentication code).

Not all passkeys support user verification. If you authenticate with your passkey and are returned to the login form instead of being signed in, see I cannot use my passkey as a passwordless login.

Before you start

To complete the actions presented below, you must have:

• Owner status
• Set up a password manager on your device

Enable a passkey

1. Go to your Account Security page.
2. In the Authentication methods section, click + Add passkey. A pop-up opens.
3. Enter the passkey name you configured in your password manager.
4. Click Start. Your password manager will be prompted, and a pop-up may appear in your browser.
5. Follow your password manager's instructions to complete the setup. A message confirms the passkey is successfully added.
6. Click Close.

Upgrade a passkey to passwordless login

1. Go to your Account Security page.
2. Next to the passkey you want to upgrade, click more icon > Upgrade to passwordless login. A pop-up appears.
3. Click Upgrade to passwordless login. Your password manager will be prompted, and a pop-up may appear in your browser to check identity verification.
4. Follow your password manager's instructions to complete the setup. A confirmation message displays once the passkey is upgraded.
5. Click Close.

If the upgrade fails, see I cannot use my passkey as a passwordless login.

Delete a passkey

1. Go to your Account Security page.
2. Next to the passkey you want to delete, click more icon > Delete. A pop-up appears.
3. Type DELETE in the box to confirm and click Delete passkey.

The passkey is removed from your Scaleway account.

Troubleshoot login issues

If you have problems logging in to the console with TOTP, see I cannot log in to my account.

If you have problems logging in to the console with a passkey, see I cannot use my passkey as a passwordless login.