What MFA protects, and what it does not
This distinction matters, so it is worth being explicit.Enabling MFA does not change your integration. API requests continue to authenticate with the
Authorization: Token ... header exactly as before. There is no code change to make and nothing to update in your deployment.Supported method
Draftable uses authenticator app (TOTP) codes. You scan a QR code once with an app on your phone, and it generates a new six-digit code every 30 seconds. Any standard authenticator app works, including Google Authenticator, Microsoft Authenticator, Authy and 1Password.Enabling MFA
1
Install an authenticator app
If you do not already use one, install an authenticator app on your phone.
2
Open your account security settings
Sign in to your Draftable account and find the multi-factor authentication option in your account settings.
3
Scan the QR code
Draftable displays a QR code. Scan it with your authenticator app, which adds an entry named Draftable.
4
Confirm with a code
Enter the six-digit code your app is showing to confirm the pairing. MFA is not active until you complete this step, which prevents you locking yourself out with a misconfigured app.
5
Save your backup codes
Store the backup codes you are given somewhere safe and separate from your phone. They are how you get in if you lose the device.
Signing in with MFA enabled
Sign in with your email and password as usual, and you are then asked for the current code from your authenticator app. Codes rotate every 30 seconds, so use the one currently displayed.If you lose access to your authenticator
Use one of your backup codes in place of an app code. Each backup code works once. If you have lost both your device and your backup codes, contact support@draftable.com from the email address on the account. For security we will need to verify your identity before removing MFA, so this is not instant.Recommendations
1
Enable MFA on any account with production credentials
The account holds the keys to your live integration.
2
Store backup codes separately from the device
A password manager or your organisation’s secrets store, not a note on the same phone.
3
Make sure more than one person can get in
If MFA is bound to one individual’s phone, their departure or a lost device becomes an outage. Make sure your team has a documented recovery path.
4
Rotate your auth token if you suspect account access
MFA prevents future sign-ins, but does not invalidate credentials already taken. If you think your account was accessed, have the auth token reset as well.