Skip to main content

Setting up Multi-Factor Authentication (MFA) on Login.gov

Updated

Login.gov requires multi-factor authentication (MFA) for all accounts. During setup, users must choose at least one authentication method and it is strongly recommended to set up more than one as a backup.

Common MFA options include:

  • Authentication app (e.g., Microsoft Authenticator) installed on a mobile device

  • Security key

  • PIV/CAC

  • Backup code - to be used if you lose access to your primary MFA method 

Make a note of which authentication method you choose so you can easily authenticate in next time you are prompted.

Options for Configuring MFA

There are many options for configuring MFA in Login.gov - choose the method that works best for you. Please contact your Program Office or Agency officials if you are unsure which method to choose.

You can select from the following options:

  • Face or touch unlock 

  • Authentication app (e.g., Microsoft Authenticator)

  • Text or voice message

  • Security key

  • Government employee ID (PIV/CAC)

  • Backup code - to be used if you lose access to your primary MFA method 

Login.gov ‘Authentication method setup’ page listing multi-factor authentication options: Face or touch unlock, Authentication application, Text or voice message, Security key, Government employee ID (PIV/CAC), and Backup codes, with a Continue button at the bottom.

Below are steps to follow for some commonly used options:

Authentication App

  1. Choose Authentication app when prompted during MFA setup

  2. Install an authenticator app on your mobile device (Microsoft Authenticator is commonly used)

  3. Login.gov will display a QR code

    Login.gov ‘Add an authentication app’ screen showing steps to name the app, open an authenticator app, scan a QR code or enter a manual code, and enter a temporary 6-digit code; QR and manual code are blurred.

  4. Open the authenticator app:

    • Add account → Scan QR code

  5. Enter the 6-digit code generated by the app into Login.gov

  6. MFA method is now active 

Security Key

  1. Choose Security key when prompted during MFA setup

  2. Insert or connect your security key:

    • USB-A or USB-C → plug into your computer

    • NFC → hold the key near your device

    • Lightning/USB-C (mobile) → connect to your phone

  3. When prompted by your browser, touch or activate the security key

  4. If required, create or enter a PIN for the security key

  5. Login.gov confirms the key registration

  6. Enter a name for the security key (for example, Primary USB Security Key)

  7. Select Save

  8. MFA method is now active 

PIV/CAC

  1. Choose Security key when prompted during MFA setup

  2. Insert your PIV or CAC card into the card reader connected to your device

  3. When prompted by your browser, select the PIV/CAC certificate

  4. Enter your PIV/CAC PIN when prompted

  5. Login.gov validates the certificate and registers the card

  6. Enter a name for the PIV/CAC (for example, GSA PIV Card or DoD CAC)

  7. Select Save

  8. MFA method is now active 

Backup code

  1. Choose “Backup codes” when prompted during MFA setup

  2. Login.gov generates a list of one-time use backup codes

  3. Select Download, Print, or Save to store the codes securely

  4. Confirm that you have saved the codes as instructed

  5. Login.gov confirms backup codes are active

Important note:
Each backup code can be used only once and are intended for emergency or temporary access (e.g., lost phone, new device, or unavailable security key). Login.gov recommends you store backup codes offline and securely.

You can regenerate new backup codes at any time in Login.gov settings. Generating new codes invalidates old ones. 

Please follow your agency's policies regarding the use of any multi-factor authentication (MFA) option. 
For more information about authentication options, visit the Login.gov Help Center,

Related to

Was this article helpful?

0 out of 0 found this helpful
Return to top