Two-factor policy for an experience
Require a code to open the dashboard or to confirm sensitive actions.
The owner can require extra verification for an experience (Settings):
- Require 2FA to open the dashboard: a code once per 12 hours per device.
- Confirm sensitive actions: a fresh code for each ban, kick, announcement, role change, revocation, key change and settings change.
Codes come from /2fa in Discord (single use, valid 90 seconds) or from your authenticator app, with replay protection. Discord commands are exempt, because Discord already authenticates the caller. Both policies are enforced on the server in every action.