Understanding & Troubleshooting Two-Factor Authentication (2FA)

Introduction

This article answers common questions about two-factor authentication (2FA), also known as multi-factor authentication (MFA). It covers the rationale for the feature, how to set up 2FA/MFA, account access and troubleshooting, as well as questions for clients using API and other access methods. 

To further strengthen the security of the FUGA platform and protect your account and catalog, we're introducing mandatory two-factor authentication (2FA) for users accessing the FUGA web interface.

Below you will find answers to common questions about this requirement, how to get started, and what to do if you experience any difficulties.

General questions

What is two-factor authentication (2FA)?

Two-factor authentication (2FA), also known as multi-factor authentication (MFA), adds an additional layer of security to your FUGA account.

In addition to your usual username and password, you will be asked to enter a temporary verification code generated by an authenticator app.

This helps prevent unauthorized access to your account, even if your password has been compromised.

Why is FUGA making 2FA mandatory?

Requiring 2FA significantly reduces the risk of unauthorized account access by ensuring that a password alone is not sufficient to log in.

Protecting your account, catalog, and business data is a priority for FUGA, and mandatory 2FA  reflects our ongoing commitment to maintaining a secure and reliable platform.

What will change now that 2FA is mandatory?

If you haven't already enabled 2FA, you will be guided through a short setup process the next time you log in to FUGA after the requirement is activated for your organization.

You will need to complete this process before continuing to use the platform.

Once configured, you will be able to log in as usual, using your password and a verification code from your authenticator app when prompted.

I've already enabled 2FA. Do I need to do anything?

No. If you have already enabled 2FA on your FUGA account, your existing configuration will remain in place. You can log in as normal.

Setting up 2FA

How do I set up 2FA?

Setting up 2FA takes just a few minutes. You will need access to an authenticator app that can generate one-time verification codes.

When prompted during login:

1. Open your authenticator app and scan the QR code displayed on the setup screen.
2. Enter the six-digit verification code generated by your app.
3. Download your backup codes and store them somewhere secure. These will allow you to access your account if you lose access to your authenticator app.
4. Confirm your account password to complete the setup.

Once completed, 2FA will be enabled for your account.

Which authenticator apps can I use?

FUGA supports authenticator apps that generate time-based one-time passwords (TOTP).

Examples include:

• Google Authenticator (Android and iOS)
• Authy
• Password managers that support one-time passwords, such as 1Password

You can use any compatible TOTP authenticator app.

Can I receive verification codes by email or SMS instead?

No. Currently, FUGA only supports verification codes generated by a compatible authenticator app. Email, SMS, and physical security keys such as YubiKey are not supported.

Will I need to enter a verification code every time I log in?

When logging in, you can select "Trust this device for 30 days".

If selected, FUGA will remember your browser for 30 days, allowing you to log in without entering a new verification code each time. After 30 days, you will be asked to verify your identity again.

We recommend using this option only on devices you personally trust.

Can I disable 2FA after setting it up?

2FA is required to access FUGA. Although you can disable your current 2FA setup in your account settings, you will be required to set it up again the next time you log in before you can continue using the platform.

Account access and troubleshooting

What are backup codes, and why should I save them?

Backup codes are an alternative way to access your FUGA account if you're unable to use your authenticator app.

You will receive these codes during the initial setup process. We strongly recommend downloading them and storing them securely, ideally in a password manager or another secure location.

FUGA does not retain a copy of your backup codes, so it's important that you keep them somewhere accessible to you.

What happens if I lose or replace my phone?

If you can no longer access your authenticator app, you can use one of your saved backup codes to log in.

If you've lost access to both your authenticator app and your backup codes, please contact FUGA Support. Our team will assess your request and advise on the next steps to recover access to your account.

Can multiple people continue using the same FUGA login?

2FA is designed for individual user accounts, with verification linked to an authenticator app.

For security reasons, each person accessing FUGA should have their own user account rather than sharing login credentials with colleagues.

If your team currently uses shared credentials, please contact your FUGA representative to arrange individual user access.

I use multiple FUGA accounts. Can I use 2FA for all of them?

Yes. If you have multiple FUGA user accounts, for example because you work with several organizations, you can configure 2FA for each account where it is available or required.

You can manage multiple account configurations within a compatible authenticator app.

Integrations and other access methods

Will mandatory 2FA affect my API integration?

Mandatory 2FA is designed for users accessing the FUGA web interface.

API v3 credentials are not affected by 2FA.

API v2 integrations are affected because they use authentication methods that are not compatible with 2FA. For this reason, mandatory 2FA is not yet enabled for organizations that still rely on API v2

If you're unsure which API version your organization uses, please contact FUGA Support.

Will 2FA affect FTP access?

No. Enabling 2FA for your FUGA account does not affect FTP access. FTP access uses username and password authentication and does not require a 2FA verification code. 

Does mandatory 2FA apply to subaccounts?

Subaccounts are not currently included in this 2FA requirement.