> For the complete documentation index, see [llms.txt](https://securitybot.gitbook.io/securitybot-knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://securitybot.gitbook.io/securitybot-knowledge-hub/command-reference/2fa.md).

# /2fa

{% hint style="success" %}
**Premium** -- 2FA registration for moderators requires a Premium subscription. **Staff Auth** (`enable` / `auth`) requires [PRO](/securitybot-knowledge-hub/plans-and-pricing/plans-and-pricing.md).
{% endhint %}

Manage your two-factor authentication (2FA) on a server. Registering for 2FA lets you use 2FA-protected [Channel Locks](/securitybot-knowledge-hub/command-reference/lock.md) and turn on [Staff Auth](/securitybot-knowledge-hub/bot-guide/scam-prevention-features/staff-auth.md), which gates your message posting behind 2FA to contain a compromised staff account. Everything here is per-user and per-server.

***

## Usage

| Subcommand   | Options | Permission | Description                                              |
| ------------ | ------- | ---------- | -------------------------------------------------------- |
| `register`   | None    | Moderator+ | Register for 2FA on this server (Premium)                |
| `deregister` | None    | Moderator+ | Deregister from 2FA on this server (Premium)             |
| `enable`     | None    | Moderator+ | Turn on Staff Auth for your account (PRO)                |
| `disable`    | None    | Moderator+ | Turn off Staff Auth for your account (Premium)           |
| `auth`       | None    | Moderator+ | Open a 30-minute posting window with your 2FA code (PRO) |

Each subcommand prompts for your current 6-digit code in a pop-up modal where required. There are no command arguments to type.

### Example

```
/2fa register
```

{% hint style="info" %}
You can also check your current 2FA registration status from `/settings view`.
{% endhint %}

***

## Subcommand Details

### `/2fa register`

Starts the 2FA registration flow:

1. SecurityBot shows a registration splash with a QR code and secret key.
2. Scan the QR code with an authenticator app.
3. A modal prompts you to enter a TOTP code to verify.
4. Once verified, you are registered for 2FA on that server.

### `/2fa deregister`

Starts the 2FA deregistration flow:

1. SecurityBot shows a deregistration confirmation splash.
2. A modal prompts you to enter your current TOTP code to confirm.
3. Your 2FA registration for that server is removed.

{% hint style="info" %}
You cannot deregister while Staff Auth is enabled. Run `/2fa disable` first.
{% endhint %}

### `/2fa enable`

Turns on [Staff Auth](/securitybot-knowledge-hub/bot-guide/scam-prevention-features/staff-auth.md) for your account. You must be registered for 2FA first. After you confirm with your current code, your messages are gated behind a 2FA posting window, and the first window opens immediately.

### `/2fa disable`

Turns Staff Auth off for your account after you confirm with your current code. Your messages are no longer gated. This works on Premium as well as PRO, so a downgraded server's staff can always clear the setting.

### `/2fa auth`

Opens a **30-minute posting window** after you enter your current code. The window runs on a fixed timer, is not extended by posting, and is not consumed by a single message. Run it again once the window lapses. This only does something while Staff Auth is enabled.

***

## Permissions

* **`/2fa` (all)** -- Moderator+ (your configured admin/mod roles, ADMINISTRATOR permission, or the server owner)
* **`register` / `deregister` / `disable`** -- Premium
* **`enable` / `auth`** -- PRO