MFA Enrollment

Multi-Factor Authentication (MFA) adds a second step to signing in: after your password, TravelFlow sends a 6-digit code to your mobile phone by SMS. This article explains how enrollment is triggered, what the setup steps look like, and what a super admin controls.

When the Enrollment Prompt Appears

You sign in as normal and land on your dashboard. A dialog titled Two-Factor Authentication then opens on top of the page. It appears when all of the following are true:

• You do not already have a phone factor enrolled on your account.
• A super admin has switched on Enable MFA in the system settings, or has used Force MFA for User on your specific account.
• Your role and your user account are not on the exemption lists.
• In Optional enforcement mode, you have not recently used Remind Me Later — that suppresses the prompt for the reminder period the admin configured (7 days by default).

Setting Up SMS Verification

SMS is the only enrollment method. There is no method-selection step, so the dialog goes straight to your phone number:

1. On the prompt, click Set Up Now. The Set Up Two-Factor Authentication dialog opens and loads a reCAPTCHA check — the Send Code button stays disabled and reads Loading... until that finishes.
2. Pick your country code from the dropdown (it defaults to +27 ZA) and type your local mobile number next to it. If a phone number is already on your profile it is filled in for you. The dialog shows the combined number underneath as you type.
3. Click Send Code. TravelFlow sends a 6-digit code by SMS and moves to the verification step.
4. Type the code into the Verification Code field. It submits automatically as soon as you enter the sixth digit, or you can click Verify. The code is valid for 5 minutes; a countdown is shown, and Resend code unlocks after 60 seconds.
5. On success the dialog shows MFA Enabled! and closes itself after a couple of seconds. From then on, signing in asks for an SMS code after your password.

If You Are Asked for Your Password Again

If your sign-in session is too old, Firebase refuses the enrollment and the dialog switches to a Session Verification Required step. Re-enter your password and click Continue. The dialog then returns to the phone step and retries sending the code automatically. This step is skipped when your session is recent enough.

Skipping the Prompt

The prompt can always be dismissed. Use Skip for Now (labelled Remind Me Later while a grace period is running), the X in the corner, Escape, or a click outside the dialog. You keep full access to TravelFlow either way — the prompt is not a block, even when the enforcement mode is set to Required. It will simply reappear the next time you sign in.

Signing In Once MFA Is Enrolled

Enter your email and password on the login page. A Two-Factor Authentication dialog opens, sends a code to your enrolled number, and shows a masked hint of that number. Enter the 6 digits and click Verify (the code auto-submits at six digits). Resend code becomes available after 60 seconds, and the session expires after 5 minutes. Closing the dialog with the X signs you back out.

The Authenticator App Option

The sign-in dialog can accept a code from an authenticator app if your account already has one registered, and offers Use Authenticator App Instead when SMS delivery looks like it has failed. TravelFlow itself provides no way to register an authenticator app — enrollment in this system is SMS only.

Profile > Security > Set up 2FA

The Two-Factor Authentication section on My Profile > Security has a Set up 2FA button, but it does not start enrollment. It opens an information page that only offers a Go to Profile link back to where you came from. Wait for the post-login prompt instead, or ask a super admin to force MFA on your account so the prompt appears.

What a Super Admin Controls

MFA is configured in the Multi-Factor Authentication card on Settings > General Settings. That page is restricted to the Super Admin role. Organization admins have no MFA controls — the Configure MFA button on their Security Overview page only shows an informational message.

• Enable MFA — the master switch. Off by default.
• Enforcement Mode — Required or Optional. This changes the wording of the prompt and whether skips are remembered; it does not lock users out of the app.
• Grace Period (days) and Reminder Period (days) — how long after enabling MFA the countdown runs, and how long a skip suppresses the prompt.
• Exempt Roles and Exempt Users — accounts that are never prompted.
• Per-user actions to force MFA on a single account, and to remove an enrolled factor.