> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Complete MFA in the Console

> Select an enrolled MFA method, verify a passcode, or use a recovery code during Console sign-in.

Lerian Console completes the second verification step for users who already have [multi-factor authentication](/en/platform/access-manager/features/mfa/overview) enabled.

Account enrollment and method management are available through the [Identity API](/en/platform/access-manager/features/mfa/api). This page covers the Console sign-in experience only.

## Before you start

***

You need:

* an active user account with authenticator-app or email MFA enabled.
* access to the selected method or an unused recovery code.
* a Console deployment configured to handle MFA sign-in.

## Complete the second verification step

***

After the password or SSO step succeeds, the Console opens the MFA verification page.

<Steps>
  <Step title="Select a method">
    Use the preferred method or select another enabled method.
  </Step>

  <Step title="Get the passcode">
    For an authenticator app, open the app and read the current code. For email, select **Email**, request the code with **Resend**, then open the message.
  </Step>

  <Step title="Enter the passcode">
    Enter the six-digit passcode and continue.
  </Step>
</Steps>

After the first email request, use **Resend** again only when the previous message did not arrive. The Console enforces a cooldown, and Auth limits resend attempts.

## Use a recovery code

***

Select the recovery-code option when an enrolled method is unavailable. Enter one unused recovery code.

<Warning>
  A recovery code works once. Store the remaining codes securely after sign-in.
</Warning>

## Recover from a failed verification

***

| Situation                       | Action                                                                                                                                           |
| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| The passcode is invalid         | Get the current passcode and try again before the submission limit is reached. The verification limit applies per user, not per sign-in session. |
| The email does not arrive       | Wait for the resend cooldown, then request one new code.                                                                                         |
| The MFA session expires         | Restart the complete sign-in flow, including the first factor.                                                                                   |
| No enrolled method is available | Use an unused recovery code. If none is available, contact an administrator and follow your organization's account-recovery procedure.           |

## Related pages

***

<Columns cols={2}>
  <Card title="Multi-factor authentication" icon="shield-halved" href="/en/platform/access-manager/features/mfa/overview">
    How MFA enrollment, verification, and recovery work.
  </Card>

  <Card title="Manage MFA via API" icon="code" href="/en/platform/access-manager/features/mfa/api">
    Enroll methods, select a preference, and manage recovery codes.
  </Card>

  <Card title="MFA deployment requirements" icon="server" href="/en/platform/access-manager/features/mfa/deployment">
    Configure Auth and the Console for MFA sign-in.
  </Card>
</Columns>