BuildWithHQBuilder console

One more step to keep the account safe.

Two-factor is enforced on sensitive builder accounts; recovery codes are the backup path.

Design preview · representative content

Two-factor authentication

Enter the 6-digit code from your authenticator app for [email protected].

Lost your device? Use a recovery code

About this page

The second step of sign-in when two-factor is on: enter the 6-digit code from your authenticator app. Lost the device? A one-time recovery code (from when you set up two-factor) gets you in instead — each recovery code works exactly once.

Behind this page/mfa-challenge · pending-mfa session

Retrieve

Reads the pending-MFA session context only; the TOTP secret stays server-side.

Save

TOTP verified app-side against the enrollment; recovery path calls sp_Auth_ConsumeMfaRecoveryCode; success issues the full session via sp_Auth_RegisterSession.

Success

  • Correct code elevates the session to full access.
  • A recovery code works once, then is burned.
  • Attempts are throttled.

CLI handoff

Implement this scaffold from the structured contract, then remove hard-coded preview rows. The source of truth is CLI Handoff and admin-cli-manifest.json.

Page IDmfa-challenge
Route/mfa-challenge
Accesspending-mfa session
Statusschema-backed-scaffold

Server-inject identity and scope values; never trust browser-supplied account, app, tenant, user, entitlement, price, or permission identifiers. Preserve the loading, empty, forbidden, failed, retrying, and completed states shown by the preview.