Rocket.Chat’s two-factor authentication (2FA) feature adds an extra layer of security by requiring users to verify their identity with two forms of authentication before accessing their accounts. When 2FA is enabled, users must enter their username and password, followed by a one-time code generated by an authenticator app or sent to their registered email. Each code is valid for a single login and cannot be reused.
To configure 2FA in your workspace, go to Manage → Workspace → Settings → Accounts → Two Factor Authentication. You can adjust the following options based on your security needs:
Setting | Description |
|---|
Enable Two Factor Authentication | Turn 2FA on or off for all workspace users. If deactivated, this setting deactivates all Two Factor Authentication methods. |
Maximum Delta | Determines how long tokens from authenticator apps remain valid. Tokens are generated every 30 seconds and remain valid for (30 × Maximum Delta) seconds. For example, if set to 10, tokens are valid for up to 300 seconds before or after their timestamp. This is useful when client device clocks are not in sync with the server. (Default: 1) |
Enable Two Factor Authentication via TOTP | Allows users to set up 2FA with authenticator apps such as Google Authenticator or Authy. |
Enable Two Factor Authentication via Email | Allows users to receive verification codes by email for login or sensitive actions. Requires SMTP to be configured and the user’s email to be verified. |
Make two factor via email available for OAuth users | Sends a temporary email code to users signing in with OAuth providers (e.g., GitHub, Google). Requires SMTP and OAuth settings to be properly configured. |
Auto opt in new users for Two Factor via Email | Automatically enables 2FA via email for new users by default. Users can disable this on their profile settings. |
Time to expire the code sent via email in seconds | Defines how long (in seconds) an emailed 2FA code remains valid. (Default: 3600 seconds) |
Maximum Invalid Email OTP Codes Allowed | Sets the maximum number of invalid email codes before the system generates a new one. It is highly recommended to use this setting along with the Block failed login attempts by Username setting. (Default: 5) |
Remember Two Factor for (seconds) | Sets the time (in seconds) during which users won’t be asked again for a code if one was already provided. (Default: 1800 seconds) |
Enforce password fallback | Requires users to enter their password for critical actions (such as updating configurations) if no other 2FA method is enabled for that user account and a password is set for them. |
Restore defaults | Restores all 2FA settings to their default values. |
Notes:
By default, 2FA is enabled via email for users who sign up with an email address. For setup instructions, see the 2FA user guide.
To reset a user’s TOTP 2FA, see the Managing users documentation.
On the premium plans, you can enforce 2FA for specific roles. Go to Manage > Workspace > Permissions, then edit the role to enable enforcement.
Users signing in through an OAuth provider, such as Google, GitHub, or GitLab, are prompted for a one-time code if they have 2FA enabled on their account.
2FA for OAuth logins
If the Modern OAuth Flow is enabled in your workspace under Manage → Workspace → Settings → OAuth, users who have two-factor authentication enabled via email or TOTP are asked to complete the 2FA challenge even when they sign in with an OAuth provider such as Google or GitHub. See the Modern OAuth Flow user guide for more details.
