Multi-Factor Authentication

Multi-factor authentication (MFA) adds a second layer of security to your account. Even if someone obtains your password, they cannot sign in without the time-based code from your authenticator app.

Setting up MFA

1. Go to Settings → Security → Two-factor authentication.
2. Click Set up.
3. A QR code is displayed on screen.
4. Open your authenticator app (Authy, Google Authenticator, or any TOTP-compatible app).
5. Tap Add account (or the + icon) in your app and scan the QR code.
6. Your app will show a 6-digit code that refreshes every 30 seconds.
7. Enter the current 6-digit code in Hubrix to confirm the setup.
8. Click Confirm.

MFA is now enabled on your account.

Recovery codes

Immediately after enabling MFA, Hubrix displays a set of recovery codes. These are single-use codes you can enter instead of your TOTP code if you lose access to your authenticator app.

Each recovery code can be used once. After you use a recovery code to sign in, it is invalidated. You can generate a new set of recovery codes from Settings → Security → Two-factor authentication → Regenerate recovery codes (this also invalidates all existing unused codes).

Signing in with MFA enabled

After entering your email and password on the sign-in page, you are prompted for a second factor:

1. Open your authenticator app.
2. Find the Hubrix entry.
3. Enter the current 6-digit code.
4. Click Verify.

The code is valid for 30 seconds. If it expires while you're typing, wait for the next code.

Using a recovery code

If you don't have access to your authenticator app, click Use a recovery code on the MFA prompt. Enter one of your saved recovery codes instead of the TOTP code.

Disabling MFA

To turn off MFA:

1. Go to Settings → Security → Two-factor authentication.
2. Click Disable.
3. You are prompted to enter your current password to confirm.
4. MFA is removed from your account.