🌐 Qwiki Manual
Administration Guide / Access Control, Users & Security / Two-Factor Authentication (2FA / TOTP)

Two-Factor Authentication (2FA / TOTP)

Standalone Qwiki includes a built-in, zero-dependency RFC 6238 Time-Based One-Time Password (TOTP) engine compatible with Google Authenticator, Bitwarden, 1Password, Authy, and Aegis.

Configuring Site-Wide 2FA Policy

  1. Open admin ▾ ➔ ⚙️ Settings ➔ 🔒 Access & Security.
  2. Set Two-Factor Authentication (2FA) Policy to one of four options:
    • Optional: Users can enroll voluntarily in their personal account settings.
    • Enforced for Admins Only (required_admins): All admin users must configure 2FA; viewer accounts remain optional.
    • Enforced for All Users (required_all): Every account on the portal must enroll in 2FA.
    • Disabled: Turns off 2FA prompts and enrollment site-wide.
  3. Click Save Settings.

Enrolling an Authenticator App

  1. Click your username in the top-right header (admin ▾) ➔ 👤 Account & Security.
  2. Scan the client-side generated SVG QR code with your authenticator app (or enter the Base32 secret manually).
  3. Enter the 6-digit verification code (30-second step) to activate 2FA.
  4. Save Your 8 Recovery Codes: Qwiki generates 8 single-use hashed recovery codes upon enrollment. Store them offline in a password manager; each code can be used once if you lose your authenticator device.
Warning

If an administrator loses both their authenticator device and all 8 recovery codes, they cannot log in through the web UI. An operator with shell access can reset 2FA safely using php bin/reset-2fa.php <username>. See CLI Utilities & Emergency Recovery.