Shellius supports two second factors: an authenticator app (TOTP) and a code sent by email. Whichever is enrolled first also produces a set of single-use backup codes.

Required permissions

Permission	Lets you
—	Everyone manages their own second factor from their profile.
settings.mfa	Set the organisation's two-factor policy.

Set the organisation policy

The policy has four switches. Saved values override the environment defaults.

Setting	Environment default	Meaning
Enabled	MFA_ENABLED (off)	Whether people can enrol a second factor at all.
Enforced	MFA_ENFORCED (off)	Whether everyone must have one.
Allow authenticator app	MFA_ALLOW_TOTP (on)	Offer TOTP.
Allow email codes	MFA_ALLOW_EMAIL_OTP (on)	Offer emailed codes.

Email codes need working email

If you allow only email codes, a mail outage locks people out. Set up and test email delivery first, and keep the authenticator app allowed.

Enrol an authenticator app

1. Start two-factor setup from your account.
2. Scan the QR code with your authenticator app.
3. Enter the code it shows to confirm. Until you confirm, the new secret is only pending and your sign-in does not change.
4. Save the backup codes. They are shown once.

Backup codes

Backup codes are stored only as hashes, so Shellius cannot show them again. You can regenerate the set, which invalidates the old one. Regenerating requires a fresh code from an enrolled factor. Turning two-factor off requires either a fresh code or your account password.

How secrets are stored

TOTP secrets are encrypted at rest with AES-256-GCM. Emailed codes are rate-limited per sign-in challenge.

Next steps

Single sign-onHand sign-in to your identity provider instead.Email deliveryRequired for emailed codes.Hardening checklistThe other settings worth locking down.