Require Two-Factor Authentication
Make two-factor authentication (2FA) mandatory for every member of your organization, choose a grace period, and understand what members see.
Organization owners and admins can require every member to protect their account with two-factor authentication (2FA). Once the policy is on, each member has a grace period to turn on 2FA; after that, they can't use the organization's pages until they do.
Turn on the policy
- Go to Settings → Organization → Security. Only owners and admins can change this setting.
- Turn on Require MFA for all members.
- Set the Grace period (days): how many days members have to turn on 2FA, from 1 to 90 (30 by default). There is no option to enforce the policy immediately: the minimum is 1 day.
Turn on 2FA on your own account first. The policy applies to owners and admins too, and once the grace period ends you can only reach the organization's settings, including this one, with 2FA turned on.
How the grace period works
The grace period starts on the later of these two dates:
- the day the policy was turned on;
- the day the member joined the organization.
Members who join while the policy is on get the full grace period from the day they join. Changing only the number of days keeps the original start date. Turning the policy off and on again starts a new grace period for everyone.
What members see
During the grace period, members without 2FA see a banner at the top of the app with the days they have left. The banner turns urgent during the last 7 days. Its button opens the 2FA setup.
After the grace period, a member without 2FA who opens a page of the organization is sent to the 2FA setup instead. Until they finish it, they can't use the organization at all:
- its pages, and the actions inside them, are unavailable;
- requests the app makes on their behalf fail with
403; - they can't manage the organization either: invite or remove members, change roles, edit or delete the organization, manage webhooks or billing, or change the security policy itself. This applies to owners and admins too.
They can still:
- turn on 2FA from their account settings, under Two-factor authentication;
- switch to another organization they belong to.
Nothing is deleted. As soon as the member turns on 2FA, they have full access again.
Integrations that authenticate with an API key keep working: the policy applies to people signing in, not to API keys.
Require MFA for all members doesn't apply yet to the OAuth access tokens of
the DocuTray CLI (docutray login --oauth) and of MCP clients. Requests made
with those tokens aren't checked against the policy, so a member blocked in the
app can keep using a CLI or MCP session they already authorized. Keep this in
mind until the policy covers them too.
Signing in with Google, GitHub, or Microsoft
Two-factor authentication also applies when a member signs in with a social account. After the provider confirms their identity, DocuTray asks for the 6-digit code from their authenticator app (or a backup code) before opening the session, and then takes them to the page they were going to.
If the member chose to trust the device when they entered the code, DocuTray doesn't ask for it again on that device for 30 days.
If the sign-in started from the DocuTray CLI (docutray login --oauth) or from
an MCP client, after entering the code you land in the app instead of returning
to the authorization screen. Run the login command again: your session is
already open, so it doesn't ask for the code again.
Validation Operators
Reference for every operator in the Docutray validation DSL — presence, comparison, numeric precision, text, lists, dates and calculated values — with a runnable example for each.
API Reference
Complete Docutray REST API reference — endpoints for document conversion, identification, document-type management, knowledge bases, and webhook automation.