Security

MFA, sessions, and trusted devices

Authkits combines MFA with fresh step-up authorization, server-side session inventory/revocation, trusted-device rotation, and a security center.

TOTP

Authenticator-app codes with encrypted seeds, replay protection, and host-controlled key rotation.

Email MFA

Short-lived codes delivered to the current verified account email through Django email.

Recovery codes

One-time recovery codes stored only as keyed digests and regenerated through protected management flows.

Configure MFA

settings.py

AUTHKITS = {
    "MFA": {
        "ENFORCED": False,
        "ALLOWED_METHODS": ["totp", "email"],
        "TOTP_ENABLED": True,
        "TOTP_ISSUER": "My App",
        "ENCRYPTION_KEYS": [env("AUTHKITS_MFA_KEY")],
    },
}

TOTP enrollment requires an independent Fernet encryption key supplied by your secret manager. Do not reuse Django's SECRET_KEY.

Fresh step-up authorization

Sensitive changes can require the current password again and, when policy requires it, a current MFA factor. Authkits issues a short-lived, single-use authorization bound to the exact action and target.

Session tracking and remote revocation

settings.py

AUTHKITS = {
    "SECURITY": {
        "SESSION_TRACKING": True,
        "TRUSTED_DEVICES": True,
    },
}

Add authkits.security.middleware.SessionSecurityMiddlewareimmediately after Django's AuthenticationMiddleware. Tracking powers active-session inventory and remote revocation.

Trusted devices

Trusted devices are opt-in, HTTPS-dependent browser conveniences. They do not become password proof and do not grant fresh authorization for later sensitive account changes.

Next steps

Review Authkits' persistent abuse controls around login, recovery, MFA, and verification.

Abuse protection