Skip to main content
AroPay supports authenticator-app 2FA using TOTP (RFC 6238: SHA-1, 30-second window, 6 digits), compatible with 1Password, Google Authenticator, Authy, and friends. Codes are single-use: a code that just succeeded is rejected if replayed within its window.
Passkeys count as strong MFA on their own (AroPay requires the authenticator to verify you with a PIN or biometric); a passkey login never prompts for a TOTP code.

​
Enable 2FA

Enrollment is session-only (the dashboard flow lives in Settings → Security) and takes two calls:
1

Set up: get the secret

Returns the base32 secret, an otpauthUri, and a qrDataUrl; render the QR for scanning, or offer the secret for manual entry. Calling setup when 2FA is already enabled returns 400 totp_already_enabled.
2

Enable: confirm with a live code and your password

Enforcement starts only after this succeeds (totpEnabled: true on your user object); an interrupted setup never locks anyone out. The password is required so that someone holding only your session can’t enroll their own authenticator and lock you out. Turning 2FA on signs out every other session (they were opened without the second factor) and refreshes the current session’s cookie; API keys keep working.

​
Logging in with 2FA

Password login becomes two steps:
The pending token is short-lived and single-purpose; no session exists until step 2 succeeds. An expired token or wrong code returns 401; just restart from step 1. Wrong codes still count toward the account’s 2FA code cap, and restarting does not reset it: the fifth code tried without an accepted one locks code entry (423 account_locked) for 15 minutes, longer with each further failure.

​
Disable 2FA

Disabling requires both your password and a live code; possession of an unlocked session alone isn’t enough. The code is single-use like any other (a replay fails with 401 totp_code_reused). A wrong password counts toward the step-up password lock, and every code tried counts toward the same code cap as sign-in:

​
Recovery

Lost the authenticator? Your Aro Media admin can clear 2FA on the account (Reset 2FA in the admin portal, the reset_2fa action). You’ll sign in with your password alone and can re-enroll a new device. A 2FA reset is a recovery action: it signs out every session and revokes all your API keys, and the admin decides whether your passkeys stay. Create new keys after you sign in (recovery). If your password leaked and someone used it to lock code entry, an admin Reset password clears that lock along with the password; 2FA stays on. Changing the password yourself does not clear it.

​
How secrets are protected

  • TOTP secrets are AES-256-GCM encrypted at rest; they exist in plaintext only transiently during verification.
  • Accepted codes are replay-guarded per time step, everywhere a code is accepted: sign-in, step-up, and disabling 2FA.
  • Login attempts remain subject to the global rate limits and lockout. Codes have their own per-account cap, shared by sign-in and step-up, that only an accepted code, re-enrolling, or an admin Reset 2FA or Reset password clears.