---
title: Protecting Tokens with MFA
slug: kron-pam-end-user-guide-3-7-0/protecting-tokens-with-mfa
docTags: 
createdAt: 2024-12-11T11:08:56.786Z
---

Kron PAM’s built-in MFA can be used as a secondary layer of authentication for logging into the Kron PAM Mobile Client Application for its online features (Approval Management, Geo-Fencing, and Password Manager). 

:::hint{type="info"}
- Admin and user must install the Kron PAM Mobile Client Application and register a token to receive Offline Tokens with the Kron PAM Mobile Client Application. (You get the Offline Tokens from the Offline Token > Add > Register Token menu).   
- OTP must be enabled for the user group that will be using MFA for the Kron PAM Mobile Client Application.  
:::


To enable MFA for Mobile Application Application: 

1. Navigate to **Administration** > **System Config. Man**.
2. Set the **mobile.application.otp.enabled** parameter as true.

After these settings were done and a login operation was started on the Kron PAM Mobile Client Application, the Kron PAM Mobile Client Application will automatically look for a Registered Token in its Offline Tokens with the name that matched the **tfa.otp.issuer** parameter. If there is a registered token with another name, then it will prompt the user to change the registered token. The user selects yes and the page forwards to the token page for entering a new token. If the token is matched user can log in. The current six-digit value of the Offline Token is validated with the Kron PAM server, login will be successful.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/depozz2Tu8kG1N1nBn0uW_image.png" size="42" width="477" height="480" position="center" caption="Token mismatch " alt="1" showCaption="true"}

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/Lcd-pa_chVp6bZ2FZj4Zh_image.png" size="42" width="428" height="491" position="center" caption="Token Code" showCaption="true"}

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/g5mG2lkd26UeR9ZfcW8Jv_image.png" size="42" width="466" height="534" position="center" caption="Token mismatch " showCaption="true"}

If there’s no Registered Token in the Kron PAM Mobile Client Application and MFA is enabled with the parameter above, registering token also requires a Multi-Factor Authentication. The system will send a one-time password (OTP) user’s phone number. The user will be asked to enter the OTP on the Kron PAM Mobile Client Application.

:::hint{type="info"}
The Kron PAM Mobile Client  MFA functionality works only with the registered tokens to ensure that the offline tokens are only working in one Kron PAM Mobile Client at a time. 
:::