--- schema_version: "1" id: 77d61d1ddbfbb83bbd92153f5987324fde9625cd1db8563bea02e9dc1d13bab7 title: Third-Party Authenticator Apps for MFA collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/mfa_supported_verification_methods_totp.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_totp.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 60de16e836a4931a81f1c6606032292b6039cb1ea47614430163b11784851202 description: Salesforce multi-factor authentication (MFA) supports the use of third-party authenticator apps that generate time-based one-time password (TOTP) codes. There are many mobile, desktop, and browser extension apps available, including free versions. Some popular options include Google Authenticator, Microsoft Authenticator, Authy, and password managers such as LastPass and 1Password. Third-party authenticator apps are considered standard-strength verification methods, so they can satisfy the MFA requirement for non-privileged users. products: - Security release: "264" --- # Third-Party Authenticator Apps for MFA Salesforce multi-factor authentication (MFA) supports the use of third-party authenticator apps that generate time-based one-time password (TOTP) codes. There are many mobile, desktop, and browser extension apps available, including free versions. Some popular options include Google Authenticator, Microsoft Authenticator, Authy, and password managers such as LastPass and 1Password. Third-party authenticator apps are considered standard-strength verification methods, so they can satisfy the MFA requirement for non-privileged users. ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_important.png) Important Salesforce enforces MFA requirements in the summer of 2026. See these articles for more information and detailed rollout timelines. - [Prepare for MFA Enforcement for All Employee Users](https://help.salesforce.com/s/articleView?id=005321561&type=1&language=en_US). - [Prepare for Phishing-Resistant MFA Enforcement for Privileged Users including Admins](https://help.salesforce.com/s/articleView?id=005321563&type=1&language=en_US). To log in using this type of verification method, the user gets a code from their authenticator app. Then they enter that code during the Salesforce login process. TOTP authenticators can generate codes even if the user’s phone doesn’t have a data or internet connection. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_note.png) Note We highly recommend that users set up a PIN or biometric requirement on their mobile device to ensure that unauthorized parties aren’t able to access their authenticator app. ## Requirements and Considerations ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_important.png) Important As a security best practice, require users to use phishing-resistant verification methods: [Troubleshoot Passkey Issues](https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_bia.htm&release=264.0.0&type=5 "When employee users log in and register for multi-factor authentication (MFA), passkeys are the default option. Identify and resolve issues with passkey prompts, setup, login, and more.") or [Security Keys (Passkeys) for MFA](https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_securitykey.htm&release=264.0.0&type=5 "Security keys are physical passkeys. They're small, USB or NFC devices that are easy to use for multi-factor authentication (MFA) logins because there's nothing to install and no codes to enter. This type of method is a great option if users don't have a mobile device or if phones aren't allowed where your users work (such as a PCI-compliant service center). Security keys require a supported browser to act as an intermediary between the key and your Salesforce product. Popular security keys include the YubiKey from Yubico and the Titan Security Key from Google. Security keys satisfy the phishing-resistant MFA requirement for privileged users."). For more information about the security benefits of these methods, see the [WebAuthn guide](https://webauthn.guide/). - Third-party authenticator apps are supported by all Salesforce products that provide MFA functionality. - Third-party authenticator apps don't satisfy the [phishing-resistant MFA requirement for privileged users](https://help.salesforce.com/s/articleView?id=xcloud.mfa_phishing_resistant.htm&release=264.0.0&type=5 "Salesforce requires multi-factor authentication (MFA) for all employee logins to Salesforce products. For internal user accounts that have a higher level of access, such as admin accounts, Salesforce requires extra security: users must complete MFA using a phishing-resistant method, such as a passkey or security key. This requirement applies to direct and single sign-on (SSO) logins for active production and sandbox orgs."). - Users can log in using any authenticator app that generates temporary codes based on the OATH time-based one-time password (TOTP) algorithm (RFC 6238). - In addition to the TOTP algorithm requirement, [products built on the Salesforce Platform](https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_products.htm&release=264.0.0&type=5 "All products that are built on the Salesforce Platform provide multi-factor authentication (MFA) functionality at no additional cost. If you aren’t sure, use this topic to verify that your product is built on the Salesforce Platform.") can use TOTP hardware tokens that meet these requirements: - Base32 encoded, 20-byte secret - 6-digit code - 30-second counter - SHA1 To associate a hardware token with a user, insert a [TwoFactorInfo](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_twofactorinfo.htm) object into the database, as described in the [Salesforce Object Reference](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_concepts.htm). Provide the Secret, the user's ID, and specify the Type field as TOTP. You can use the Data Loader, Workbench, or custom Apex to insert TwoFactorInfo objects into the database. - We recommend using mobile authenticator apps because they exist separately from a user's laptop or workstation. That way, if a bad actor manages to gain access to a user's computer, the user's second factor isn't also compromised. However, if a desktop authenticator app or browser extension is the only option that works for your users, you can satisfy the MFA requirement with these types of methods. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_note.png) Note The Synebo Chrome extension doesn’t comply with the MFA requirement. Many password managers allow users to generate TOTP codes for MFA authentication. We recommend using this capability only from password managers that are accessed from mobile devices, or if the password manager itself has MFA protection (for example, using biometric authentication). ## Behind the Scenes TOTP authenticator apps generate temporary codes on the basis of a secret key (known only to the user and the service, such as Salesforce) and the current time. A code is valid for 30 seconds and then a new one is generated. #### See Also - [Register a Third-Party Authenticator App as an Identity Verification Method](https://help.salesforce.com/s/articleView?id=xcloud.add_time-based_token.htm&type=5&language=en_US) - [MFA Verification Methods for Direct Salesforce Login](https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods.htm&release=264.0.0&type=5 "The multi-factor authentication (MFA) login process requires users to provide an identity verification method in addition to their username and password. Salesforce MFA functionality supports several types of verification methods, including passkeys (built-in authenticators and security keys) and authenticator apps. You can control which methods are available to your users.")