---
title: Two-Factor Authentication
slug: kronpam-end-user-guide-3-4-0/two-factor-authentication
description: Learn how to enhance device security with Kron PAM's Two-Factor Authentication (2FA). This document guides system admins on configuring and testing 2FA during deployment and demonstrates how to use offline functionality with the mobile app. Discover how t
docTags: 
createdAt: 2022-08-12T12:41:52.000Z
---

You can use Kron PAM for Two-Factor Authentication (2FA) to know who reaches your devices.

 System admins configure and test 2FA definitions during deployment.

Kron PAM 2FA is available in offline mode with the mobile application. 

:::hint{type="info"}
2FA code will be generated for a pre-set time interval on the mobile application.
:::

# Offline Token

### Adding Offline Token

Follow the steps below to add an offline toke

1. Log in to Kron PAM Web GUI.
2. Navigate to **Administration > Multi-factor Authentication > User Token Management**. To generate a new QR, select the **option** and click **Send Token** button. You can select at least one of the send token options (**Via SMS, via Email, or Via Access Link**) and click the **SEND** button.
3. Open the Kron PAM Mobile Client App and log in with your Kron PAM user.
4. Navigate to **Offline Token- QR Code, Enter Manually or Register Token.**
5. Generate a token with any of the following methods:
   - Scan QR code – you must allow the app to access and use the camera
   - Enter the code manually with your username
   - Register token.

You will see your generated tokens on the Offline Token screen. 

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/EsvuH3QwRBknqnZ57lf9E_.blob "Sending a QR Code via User Token Management ")

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/VLQZWlL7HiyBVUcbQduvO_image.png" size="38" width="313" height="500" position="center" caption="Offline Token " showCaption="true"}

### Exporting and Importing Token

You can export your tokens to copy them to another device or simply protect them from loss due to updates.

To export:

1. Tap on the **Offline Token** menu.
2. Select **Export, **and it copies the collection of tokens in an encoded format and adds them to the clipboard.
3. To keep it as a backup, paste it into notes or email.

To import a backup:

1. Select and copy the backup text you stored in notes, email, etc.
2. Tap on the **+ **button on the top-right corner, and the activation screen opens.
3. Select **Import Token**.
4. Tap on **OK** on the *Your tokens are imported successfully* dialog box.

# Protecting Tokens with MFA

Kron PAM’s built-in MFA can be used as a secondary layer of authentication for logging into the Mobile Application for its online features (Approval Management, Geo-Fencing, and Password Manager). 

:::hint{type="info"}
- Admin and user must install the Kron PAM Mobile App and register a token to receive Offline Tokens with the mobile app. (You get the Offline Tokens from the Offline Token > Add > Register Token menu).   
- OTP must be enabled for the user group that will be using MFA for Mobile Application connections. 
:::


To enable MFA for Mobile Application: 

1. Navigate to **Administration** > **System Config. Man**.
2. Set the **mobile.application.otp.enabled **parameter as true.
   After these settings are done and a login operation was started on the mobile application, the application will automatically look for a Registered Token in its Offline Tokens with the name that matched the tfa.otp.issuer parameter. If there are registered tokens with other names, then it will prompt for user to select a registered token. If the current six-digit value of the Offline Token (either the automatically or the manually selected one) is validated with the server, login will be successful.
   If there’s no Registered Token in the mobile application and MFA is enabled with the parameter above, registering token also requires a Multi Factor Authentication. The system will send a one-time password (OTP) user’s phone number. User will be asked to enter the OTP on his/her mobile application.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/depozz2Tu8kG1N1nBn0uW_image.png" size="42" width="477" height="480" position="center" caption="Token mismatch " alt="1" showCaption="true"}

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/Lcd-pa_chVp6bZ2FZj4Zh_image.png" size="42" width="428" height="491" position="center" showCaption="false"}

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/g5mG2lkd26UeR9ZfcW8Jv_image.png" size="42" width="466" height="534" position="center" showCaption="false"}

If there’s no Registered Token in the mobile application and MFA is enabled with the parameter above, registering token also requires a Multi-Factor Authentication. The system will send a one-time password (OTP) user’s phone number. The user will be asked to enter the OTP on his/her mobile application.  

:::hint{type="info"}
The Mobile Application MFA functionality works only with the registered tokens to ensure that the offline tokens are only working in one application at a time. 
:::