Setting Up Two-Factor Authentication

Setting Up Two-Factor Authentication

Two-factor authentication (2FA, also known as MFA) adds a second verification step to your account login. PetRock.cloud strongly recommends enabling MFA for all users, and enforces it at the workspace level for the Boulder and Monolith tiers.

Supported methods

You can enroll multiple methods. We recommend at least one phishing-resistant method (hardware key) plus a backup method.

Enrolling an authenticator app

1. Navigate to Settings → Account → Two-Factor Authentication.
2. Click Add Authenticator App.
3. Open your authenticator app and scan the displayed QR code.
4. Enter the 6-digit code generated by the app.
5. Click Verify.

You will be shown 10 single-use backup codes. Save these in a secure location such as a password manager. Each code can be used once if you lose access to your authenticator.

Enrolling a hardware security key

1. Navigate to Settings → Account → Two-Factor Authentication.
2. Click Add Security Key.
3. Insert your security key when prompted.
4. Tap or press the key to confirm.
5. Give the key a memorable name (e.g., "Yubikey 5C - Work").

You can register multiple keys. We recommend keeping a primary and a backup key.

Enrolling SMS as a backup

1. Navigate to Settings → Account → Two-Factor Authentication.
2. Click Add SMS.
3. Enter your phone number with country code.
4. Enter the code sent to your phone.

Warning: SMS-based MFA is vulnerable to SIM swap attacks. Use it only as a backup, and disable it once you have a more secure method enrolled.

Workspace-level enforcement

Workspace administrators can require MFA for all users in the workspace.

1. Navigate to Settings → Security → MFA Enforcement.
2. Toggle Require MFA for all users.
3. Optionally, set a grace period (default 14 days) during which users will be prompted to enroll.

After the grace period, users without MFA will be unable to log in until they complete enrollment.

Recovery if you lose access

If you have lost access to all enrolled methods and have no backup codes:

1. Visit app.petrock.cloud/account-recovery.
2. Enter your email address.
3. Complete the identity verification flow, which includes:
   • Confirming a recent invoice number
   • Verifying a secondary email if configured
   • Optionally, video verification with the support team for high-trust accounts

Recovery typically completes within 1-3 business days. We do not bypass MFA via email-only verification.

MFA for API access

API tokens are not subject to MFA prompts, since they are non-interactive. To improve API security:

• Scope tokens to the minimum permissions required (see OAuth 2.0 for Rocks)
• Rotate tokens on a regular cadence
• Store tokens in a secrets manager rather than in source control

Audit log entries

All MFA enrollments, removals, and successful or failed challenges are logged to the audit log. Review at Audit Log → Filter by category: Authentication.

Related articles

• SOC 2 Type II for Your Rock
• OAuth 2.0 for Rocks
• Adopting Your First Rock