---
title: Using MFA for Mobile Application
slug: singleconnect-reference-guide-3-3-0/using-mfa-for-mobile-application
description: Increase the security of your Single Connect Mobile Application with built-in multi-factor authentication (MFA). Learn how to enable MFA, register a token, and ensure that only registered tokens are used for offline authentication. Keep your mobile app se
docTags: 
createdAt: 2022-07-31T18:06:05.000Z
---

Single Connect’s built-in MFA can be used as a secondary layer of authentication for logging into the Mobile Application for its online features (Approval Management, Geo-Fencing, and Password Manager).


To enable MFA for Mobile Applications:

:::hint{type="info"}
- Admin and user must install the Single Connect Mobile App and register a token to receive Offline Tokens with the mobile app. (You get the Offline Tokens from the Offline Token > Add > Register Token menu).
- MFA must be enabled for the user group that will be using MFA for Mobile Application connections. (See sections [Sending MFA QR Code to Users](docId\:N5h8LvfjlvnlnBg1LXfs6), [Creating a Connection Between Single Connect and the Single Connect Mobile Application](docId\:MyQ5n_BFc_PN84wbRVMAL), [Enabling Multi Factor Authentication (MFA)](docId\:U2oncfg32vjondgOb1T5R) 
:::

1. Navigate to **Administration **> **System Config. Man**.
2. Set the **mobile.application.otp.enabled **parameter as true.

After these settings are done and a login operation was started on the mobile application, the application will automatically look for a Registered Token in its Offline Tokens with the name that matched the tfa.otp.issuer parameter. If there is a registered token with another name, then it will prompt the user to change a registered token. The user selects yes and enters a new token on the next page window forward to the token page for entering a new token. If the token is matched the user can log in. Once the current six-digit value of the Offline Token is validated with the server, login will be successful.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/xyWbC88xjwYVzGzTNSpQL_image.png" size="44" width="295" height="470" caption="Token mismatch " position="center" showCaption="true"}



::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/o7WLTxF_NBIVL_U5YJDZB_image.png" size="44" width="296" height="467" caption="Token mismatch " position="center" showCaption="true"}



::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/25p2M8yc1ZmVMGc77KrpZ_image.png" size="44" width="312" height="467" caption="Token mismatch " position="center" showCaption="true"}

If there’s no Registered Token in the mobile application and MFA is enabled with the parameter above, registering a token also requires a Multi-Factor Authentication. The system will send a one-time- password (OTP) to the user’s phone number. The user will be asked to enter the OTP on his/her mobile application.

:::hint{type="info"}
The Mobile Application MFA functionality works only with the registered tokens to ensure that the offline tokens are only working in one application at a time.
:::