MFA & staff auth
Email second factor for platform staff, stateless by design, enforceable platform-wide.
Updated
On this page
The flow
Platform staff sign in with email + password against the platform API. With MFA on, the password check succeeds but the session token is parked: it is sealed inside a signed, httpOnly cookie together with the hash of a 6-digit code that is emailed to the user. Only after the code checks out is the real session released.