> For the complete documentation index, see [llms.txt](https://fusionauth.io/docs/llms.txt)

# Multi-Factor API | FusionAuth Docs

Learn about the APIs for enabling and disabling multi-factor authentication for users.

# Multi-Factor API

[Edit on GitHub](https://github.com/FusionAuth/fusionauth-site/blob/main/astro/src/content/docs/apis/two-factor/index.mdx)

[View Markdown](https://fusionauth.io/docs/apis/two-factor.md)

Email and phone multi-factor methods are only available in a paid plan of FusionAuth. Please visit [our pricing page](https://fusionauth.io/pricing.md) to learn more about paid plans.

This API controls [multi-factor authentication (MFA)](https://fusionauth.io/docs/lifecycle/authenticate-users/multi-factor-authentication.md) options.

## Authentication

Some of these operations can use JWT authentication instead of API key authentication. In some cases, when you have a valid **twoFactorId**, neither a JWT nor an API key is required.

Learn more about [JWT authentication and see examples here](https://fusionauth.io/docs/apis/authentication.md#jwt-authentication).

## TOTP Implementation

Support for Authy, Google Authenticator and other time based one-time password solutions are not premium features and are included in the Community plan.

While there is underlying support for different code lengths, algorithms and time steps, at the current time the system only allows for the following TOTP settings:

| Configuration setting | Currently allowed value |
| --- | --- |
| `authenticator.algorithm` | `HmacSHA1` |
| `authenticator.codeLength` | `6` |
| `authenticator.timeStep` | `30` |

Any attempt to change these configuration values will currently be ignored. If you need different configuration settings, please file a [GitHub issue detailing your use case](https://github.com/fusionauth/fusionauth-issues/issues).

Use the following APIs to manage Multi-Factor authentication:

| Operation | Method | Endpoint |
| --- | --- | --- |
| [Enable Multi-Factor](https://fusionauth.io/docs/apis/two-factor/enable-multi-factor.md) | `POST` | `/api/user/two-factor/{userId}`  
`/api/user/two-factor` |
| [Disable Multi-Factor](https://fusionauth.io/docs/apis/two-factor/disable-multi-factor.md) | `DELETE` | `/api/user/two-factor/{userId}?code={code}&methodId={methodId}`  
`/api/user/two-factor/{userId}`  
`/api/user/two-factor`  
`/api/user/two-factor?code={code}&methodId={methodId}` |
| [Update Multi-Factor Method](https://fusionauth.io/docs/apis/two-factor/update-multi-factor-method.md) | `PUT` | `/api/user/two-factor/{userId}?methodId={methodId}` |
| [Generate a Secret](https://fusionauth.io/docs/apis/two-factor/generate-a-secret.md) | `GET` | `/api/two-factor/secret` |
| [Start Multi-Factor](https://fusionauth.io/docs/apis/two-factor/start-multi-factor.md) | `POST` | `/api/two-factor/start` |
| [Retrieve Multi-Factor Status](https://fusionauth.io/docs/apis/two-factor/retrieve-multi-factor-status.md) | `GET`  
`POST` | `/api/two-factor/status/{twoFactorTrustId}`  
`/api/two-factor/status` |
| [Send a Multi-Factor Code During Login or Step Up](https://fusionauth.io/docs/apis/two-factor/send-a-multi-factor-code-during-login-or-step-up.md) | `POST` | `/api/two-factor/send/{twoFactorId}` |
| [Send a Multi-Factor Code When Enabling MFA](https://fusionauth.io/docs/apis/two-factor/send-a-multi-factor-code-when-enabling-mfa.md) | `POST` | `/api/two-factor/send` |
| [Send a Multi-Factor Code When Disabling MFA](https://fusionauth.io/docs/apis/two-factor/send-a-multi-factor-code-when-disabling-mfa.md) | `POST` | `/api/two-factor/send` |
| [Generate Recovery Codes](https://fusionauth.io/docs/apis/two-factor/generate-recovery-codes.md) | `POST` | `/api/user/two-factor/recovery-code/{userId}` |
| [Retrieve Recovery Codes](https://fusionauth.io/docs/apis/two-factor/retrieve-recovery-codes.md) | `GET` | `/api/user/two-factor/recovery-code/{userId}` |