--- title: "Offer two-factor login ยท Agent Wranglers" url: https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/two-factor-login updated: 2026-10-21 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Offer two-factor login For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Second factors and recovery](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21. - ID: ACC-70 - Level: Required - Chapter: [Second factors and recovery](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery) - Rule: Require a second factor for staff and for admins of customer organisations, and offer one to every user. Staff use only passkeys or security keys. - Risk: An account or system taken over - Applies when: The project has user accounts. - How: Staff are your own people who run the admin tool or support. They use phishing-resistant factors only, which means passkeys or security keys, as NIST SP 800-63B-4 and CISA advise. Admins and owners of a customer organisation need any factor that is not SMS alone, such as an authenticator app or a passkey. Offer passkeys first to them and to every customer, as [offer second factors from strongest to weakest](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/second-factor-choice) says. Avoid text messages where you can, because numbers can be hijacked. Rate limit code entry, give one-time recovery codes, and ask again for the second factor before changing it. See also [give recovery codes with the first second factor](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/recovery-codes) and [plan for losing every factor](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/recovery-without-factors). - Check: Log in as a test staff member and as a test customer-organisation admin with only the password. Both are refused until the second factor is given. An authenticator app code is not accepted for staff. On the test copy, ten wrong codes in a row are slowed or blocked. ## Sources - [NIST SP 800-63B-4 Authentication and Authenticator Management](https://pages.nist.gov/800-63-4/sp800-63b.html) - [CISA fact sheet on implementing phishing-resistant MFA](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf) ## Related rules - [Protect the accounts that can change the code](https://agentwranglers.se/playbook/engineering/version-control-and-review/code-host-accounts) in Engineering - [Keep the domain name yours](https://agentwranglers.se/playbook/website/hosting-and-network/domain-renewal) in Website - [Slow down password guessing](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/login-guessing) in Security testing - [Publish your packages without stored tokens](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/trusted-publishing) in Security testing - [Sign people in through single sign-on](https://agentwranglers.se/playbook/infrastructure/identity-and-access/single-sign-on-for-people) in Infrastructure - [Hold every sign-in path to the same checks](https://agentwranglers.se/playbook/accounts/sign-in-methods/same-checks-every-path) in Accounts - [Offer second factors from strongest to weakest](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/second-factor-choice) in Accounts - [Confirm a second factor before turning it on](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/mfa-enrolment) in Accounts - [Ask everyone to keep two ways in](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/two-authenticators) in Accounts - [Let organisations require a second factor](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/org-mfa-policy) in Accounts - [Tell people when their password worked but the second factor failed](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/failed-second-factor) in Accounts - [Give recovery codes with the first second factor](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/recovery-codes) in Accounts - [Plan for losing every factor](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/recovery-without-factors) in Accounts - [Use separate staff accounts](https://agentwranglers.se/playbook/accounts/support-and-staff-access/staff-accounts) in Accounts **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers accounts playbook`. In code you write, add a comment next to it with the same link. - Previous: [Let a remembered device skip only the second factor](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/remembered-device) - [Second factors and recovery](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery)