Multi-Factor Authentication

Multi-factor authentication (MFA) adds a second verification step when you sign in, protecting your account even if your password is compromised. After entering your email and password, you'll be asked to provide a temporary code from your phone or authenticator app before access is granted.

Available MFA Methods

1st Flock supports two MFA methods:

SMS — A six-digit code is sent via text message to your registered phone number each time you sign in. This is the simplest option and requires no additional software.

Authenticator App (TOTP) — A time-based one-time password generated by an authenticator app such as Google Authenticator, Authy, or Microsoft Authenticator. The app generates a new six-digit code every 30 seconds. This method works without a cellular connection and is considered more secure than SMS.

Setting Up MFA

When your account requires MFA (either because you enabled it or your church administrator requires it), you'll be prompted to choose a method during sign-in.

SMS Setup

1. Select SMS as your MFA method.
2. Enter your phone number when prompted.
3. You'll receive a text message with a verification code.
4. Enter the code to confirm your phone number and complete setup.

Going forward, each time you sign in, a new SMS code will be sent to the same phone number.

Authenticator App Setup

1. Select Authenticator App as your MFA method.
2. A QR code is displayed on screen. Open your authenticator app and scan the QR code. If you can't scan the code, a text-based secret key is also provided that you can enter manually.
3. Your authenticator app will begin generating six-digit codes. Enter the current code to verify the setup.

Going forward, each time you sign in, open your authenticator app and enter the current code.

Signing In with MFA

After entering your email and password, you'll see a verification screen asking for your MFA code. Enter the six-digit code from your SMS message or authenticator app and click "Verify." If the code is correct, you'll be signed in and redirected to your destination.

Codes are time-sensitive. If an SMS code expires, you can request a new one. For authenticator apps, wait for the current code to refresh (every 30 seconds) and try the newest code.

Required vs. Optional MFA

Church administrators can require MFA for all users in their organization. If MFA is required and you haven't set it up yet, you'll be guided through the setup process the next time you sign in — you won't be able to skip it.

If MFA is not required by your church, you can still enable it voluntarily for added security.

Troubleshooting

"Invalid code" — Make sure you're entering the most recent code. SMS codes expire after a few minutes, and authenticator app codes change every 30 seconds. If using an authenticator app, ensure your device's clock is accurate, as TOTP codes depend on the current time.

Not receiving SMS codes — Verify that the phone number on your account is correct and that your phone can receive text messages. Some carriers may delay or block automated messages. If SMS continues to fail, consider switching to an authenticator app.

Lost access to your authenticator app — If you no longer have access to the device with your authenticator app, contact support@1stflock.com. Our team can verify your identity and help you reset your MFA settings.