Skip to main content
Privy enables users to set up multi-factor authentication (MFA) for embedded wallets on both EVM networks and Solana. MFA secures the embedded wallet by requiring additional identity verification for wallet actions, subject to the MFA verification duration. images/MFA.png Once a user enrolls in wallet MFA, the user must complete MFA verification for actions that use the embedded wallet’s private key, subject to the MFA verification duration. This includes signing messages, sending transactions, exporting the wallet, and recovering the wallet on new devices.
If a user has multiple embedded wallets (e.g. on different blockchains, or multiple HD addresses), MFA enrollment applies to signatures and transactions from all of them.
Privy currently supports three methods of wallet MFA:
  • Passkeys (recommended): users verify with a previously registered passkey through biometric authentication on their device. Phishing-resistant, device-bound, and independent of third-party carriers or apps.
  • Time-based one-time password (TOTP), where users verify with a 6-digit MFA code from an authentication app, like Authy or Google Authenticator
  • SMS, where users verify with a 6-digit MFA code sent to their phone number
SMS-based MFA is vulnerable to SIM-swapping and interception attacks. For higher-security applications, use passkeys or TOTP instead.
Enabling MFA on one active session affects all other active sessions. If a user has multiple sessions (e.g. mobile and web), MFA challenges appear on every session.

​
Policy-based multi-factor authentication

By default, MFA enrollment requires verification for all wallet actions. Your app can implement policy-based MFA to require MFA only for specific actions while allowing routine transactions to proceed without additional verification. For example, your app can:
  • Require MFA only for transactions above a certain amount (e.g., transfers over 1000 USDC)
  • Require MFA for withdrawals while allowing deposits without MFA
  • Apply MFA requirements based on specific tokens, contracts, or actions
Your app achieves this by combining MFA with wallet policies and authorization keys for fine-grained control over when MFA triggers.
Learn how to implement policy-based MFA in the policy-based MFA recipe.