Why every sensitive action now asks for a second factor

The control plane vault holds the keys to your LLM spend. If a session is hijacked, that's where the damage happens: add a rogue provider key, mint device tokens, wipe the account. The answer isn't another checkbox on login — it's guarding the actions that matter.

The design: guard the action, not just the login

Login 2FA stops the intruder at the door, but says nothing about a session that was already hijacked, or a user whose machine is compromised. Instead, the plane guards the sensitive surface: adding/removing API keys, generating or revoking device keys, forgetting devices, deleting agents, and the factory reset. Each requires a fresh verification:

POST /api/v1/mona/2fa/challenge  {code, via: totp|email|backup}
→ grants 15 minutes of sensitive actions in this session

One code unlock, not per-click nagging. The grant lives in the session, expires after 15 minutes, and is revoked immediately after disabling 2FA.

Three channels, one goal

• TOTP (RFC 6238) — the primary channel, via Google Authenticator, Authy or 1Password. The secret is generated server-side, shown once as a QR + key, and stored per user.
• Email OTP — a 6-digit code through the site's own SMTP mailer, 10-minute expiry, hashed at rest, 5-attempt lockout and 3-sends-per-10-minutes throttle. Your fallback when the authenticator app is lost.
• Recovery codes — 8 one-time codes issued at enrollment, stored as SHA-256 hashes, consumed on use. Print them; they're the escape hatch.

The dashboard flow

Because every guarded call goes through one API helper, the front-end can detect 403 code=2fa_required automatically: it opens a verification modal, accepts a code, and retries the original request. Users don't think about "challenges" — they just get asked for a code exactly when something sensitive is about to happen.

What it changes in practice

Before: one password between an attacker and the vault. After: a password plus a possession factor plus a fresh challenge per sensitive action. For a control plane whose whole pitch is "your keys stay in the vault", that's the difference between a feature and a liability.