> ## Documentation Index
> Fetch the complete documentation index at: https://help.draftable.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Multi-factor authentication for your Draftable API account

> The Draftable API supports multi-factor authentication on your account sign-in using an authenticator app. This article explains what it protects, how to enable it, and how it relates to your API credentials.

Your Draftable API account can be protected with **multi-factor authentication (MFA)**, requiring a time-based code from an authenticator app in addition to your password when you sign in.

## What MFA protects, and what it does not

This distinction matters, so it is worth being explicit.

|                                                                                                         | Protected by                  | MFA applies? |
| :------------------------------------------------------------------------------------------------------ | :---------------------------- | :----------: |
| **Signing in to your account** on the Draftable website, where you view credentials, usage and settings | Password, plus MFA if enabled |      Yes     |
| **API requests** from your application                                                                  | Your auth token               |      No      |

<Note>
  Enabling MFA **does not change your integration**. API requests continue to authenticate with the `Authorization: Token ...` header exactly as before. There is no code change to make and nothing to update in your deployment.
</Note>

MFA protects the account itself. That matters because someone who signs in to your account can view and reset your API credentials, which is the more valuable target.

## Supported method

Draftable uses **authenticator app (TOTP)** codes. You scan a QR code once with an app on your phone, and it generates a new six-digit code every 30 seconds.

Any standard authenticator app works, including Google Authenticator, Microsoft Authenticator, Authy and 1Password.

## Enabling MFA

<Steps>
  <Step title="Install an authenticator app">
    If you do not already use one, install an authenticator app on your phone.
  </Step>

  <Step title="Open your account security settings">
    Sign in to your Draftable account and find the multi-factor authentication option in your account settings.
  </Step>

  <Step title="Scan the QR code">
    Draftable displays a QR code. Scan it with your authenticator app, which adds an entry named **Draftable**.
  </Step>

  <Step title="Confirm with a code">
    Enter the six-digit code your app is showing to confirm the pairing. MFA is not active until you complete this step, which prevents you locking yourself out with a misconfigured app.
  </Step>

  <Step title="Save your backup codes">
    Store the backup codes you are given somewhere safe and separate from your phone. They are how you get in if you lose the device.
  </Step>
</Steps>

## Signing in with MFA enabled

Sign in with your email and password as usual, and you are then asked for the current code from your authenticator app. Codes rotate every 30 seconds, so use the one currently displayed.

<Warning>
  Codes are time-based, so your phone's clock must be reasonably accurate. If codes are consistently rejected, check that automatic time synchronisation is enabled on the device. This is the most common cause of a working authenticator suddenly failing.
</Warning>

## If you lose access to your authenticator

Use one of your **backup codes** in place of an app code. Each backup code works once.

If you have lost both your device and your backup codes, contact **[support@draftable.com](mailto:support@draftable.com)** from the email address on the account. For security we will need to verify your identity before removing MFA, so this is not instant.

## Recommendations

<Steps>
  <Step title="Enable MFA on any account with production credentials">
    The account holds the keys to your live integration.
  </Step>

  <Step title="Store backup codes separately from the device">
    A password manager or your organisation's secrets store, not a note on the same phone.
  </Step>

  <Step title="Make sure more than one person can get in">
    If MFA is bound to one individual's phone, their departure or a lost device becomes an outage. Make sure your team has a documented recovery path.
  </Step>

  <Step title="Rotate your auth token if you suspect account access">
    MFA prevents future sign-ins, but does not invalidate credentials already taken. If you think your account was accessed, have the auth token reset as well.
  </Step>
</Steps>

## Related articles

<CardGroup>
  <Card title="Authenticating with the Draftable API" icon="key" href="/hc/en-us/articles/Draftable-API-authentication" iconType="solid" horizontal />

  <Card title="Test and production accounts" icon="flask" href="/hc/en-us/articles/Draftable-API-test-and-production-accounts" iconType="solid" horizontal />

  <Card title="Document privacy with Draftable API" icon="lock" href="/hc/en-us/articles/42553018962841-Document-Privacy-with-Draftable-API" iconType="solid" horizontal />
</CardGroup>