> For the complete documentation index, see [llms.txt](https://securitybot.gitbook.io/securitybot-knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://securitybot.gitbook.io/securitybot-knowledge-hub/bot-guide/scam-prevention-features/staff-auth.md). # Staff Auth {% hint style="warning" %} **PRO only** — Staff Auth requires a [PRO subscription](/securitybot-knowledge-hub/plans-and-pricing/plans-and-pricing.md). Each staff member also needs to be [registered for 2FA](/securitybot-knowledge-hub/command-reference/2fa.md) first. {% endhint %} A compromised moderator or admin account is one of the most damaging things that can happen to a community. An attacker who steals that account can post scam links with a trusted name behind them, and members are far more likely to click. Staff Auth contains that damage: while it is on, a staffer's messages are removed unless they have recently proven they hold their 2FA code. An attacker who has the account but not the authenticator cannot post in their name. Staff Auth is **opt-in per staff member**. Each moderator or admin turns it on for their own account. It is separate from 2FA registration, so registering for [Channel Locks](/securitybot-knowledge-hub/bot-guide/scam-prevention-features/channel-locks.md) does not gate your posting on its own. *** ### How It Works Once a staffer enables Staff Auth on your server: * **Messages are gated.** Any message they send is removed on arrival unless they have an active posting window. * **A window is opened with 2FA.** Running `/2fa auth` and entering a current code opens a posting window for **30 minutes**. * **The window has a hard expiry.** It runs on a fixed 30-minute timer. Posting does not extend it and it is not consumed by a single message. When it lapses, the staffer runs `/2fa auth` again. * **Enabling opens the first window immediately**, so turning Staff Auth on never silences someone mid-conversation. * **A stolen account is silenced.** An attacker without the 2FA code cannot open a window, so nothing they post survives. {% hint style="warning" %} Staff Auth gates **message posting only**. It does not restrict bans, kicks, role changes, or other privileged actions. Discord gives a bot no way to block those. Staff Auth silences a compromised account's voice; it is not a substitute for removing a breached account's permissions. {% endhint %} *** ### Turn Staff Auth On Staff Auth is enabled by each staff member on their own account. 1. Register for 2FA first, if you have not already: ``` /2fa register ``` 2. Enable Staff Auth: ``` /2fa enable ``` You will see a confirmation splash explaining what enabling does, then a prompt to enter your current 2FA code. Once confirmed, Staff Auth is active on your account for that server and your first posting window opens right away. *** ### Open a Posting Window While Staff Auth is enabled, unlock posting for 30 minutes by entering a current 2FA code: ``` /2fa auth ``` If the window lapses and you try to post, your message is removed and SecurityBot sends you a direct message with a copy of what you wrote, so you can run `/2fa auth` and resend it. Every blocked message is also recorded in your server's log channel. *** ### Turn Staff Auth Off To stop gating your messages: ``` /2fa disable ``` You will be asked for a current 2FA code to confirm. After disabling, your messages are no longer gated. {% hint style="info" %} You cannot deregister from 2FA (`/2fa deregister`) while Staff Auth is enabled, because that would leave your account gated with no way to authenticate. Disable Staff Auth first, then deregister. {% endhint %} *** ### If a Staffer Loses Their Authenticator If a moderator or admin loses access to their authenticator app, the **server owner** can reset them from the dashboard. This is the recovery path, and it is owner-only so a compromised admin cannot strip protection from others. 1. Open your [server dashboard](https://securitybot.info/dashboard) and select your server. 2. Go to **Configure → Staff Auth**. 3. Find the staff member and choose **Reset**. Resetting turns off their Staff Auth gate and removes their 2FA enrollment. The staffer then sets up 2FA again with `/2fa register` and re-enables Staff Auth when ready. A reset never changes anyone's Discord roles or permissions. {% hint style="info" %} Admins can open **Configure → Staff Auth** to see which of your moderators and admins have Staff Auth protecting their account. Only the server owner can reset a staffer. {% endhint %} *** ### Safety Behavior * **It never locks out your whole team.** If SecurityBot briefly cannot reach the service that tracks posting windows, Staff Auth fails open, messages are allowed through rather than blocked, and an alert is sent to your log channel. * **Repeated wrong codes are throttled.** Too many incorrect codes temporarily locks code entry for a few minutes and raises a breach alert, so a stolen account cannot be brute-forced. * **A burst of blocked messages raises an alert**, giving your team an early signal that a protected account may be compromised. *** ### Requirements * **PRO** subscription * Each staff member must be **registered for 2FA** (`/2fa register`) before enabling Staff Auth * SecurityBot must be able to **manage messages** so it can remove posts sent without an active window *** ### What Happens on Downgrade If your server is downgraded from PRO, Staff Auth stops gating messages and your staff can post normally. No one is locked out. Turning Staff Auth off with `/2fa disable` keeps working on Premium, so a downgraded server's staff can always clear the setting. *** Next up: Detect suspicious activity with [Webhook Detection](/securitybot-knowledge-hub/bot-guide/scam-prevention-features/webhook-detection.md).