Back to rankings

Base44 Lets You Require MFA for Your App Users

Base44View original changelog

Base44 now lets app owners require multi-factor authentication for everyone who signs in to their app. After a password or social login, users enter a code from an authenticator app or a text message. The feature needs the Builder plan or higher, and owners can reset a user's MFA from the App Users page.

Key Takeaways

  • Base44 apps can now require MFA for all end users, closing the gap where a stolen password alone granted access.
  • Users can verify with an authenticator app or SMS codes, and SMS codes consume the workspace's integration credits.
  • MFA is off by default and needs the Builder plan or higher, so owners must opt in from Dashboard, Settings, Authentication.
  • Apps with custom login pages must be updated first, otherwise users are locked out when the setting is switched on.
  • There are no recovery codes, so an owner with edit access resets a user's MFA from the App Users page, which also signs the user out everywhere.
  • Enforcement is all-or-nothing, with SSO users as the only exception because their identity provider handles MFA.

Require MFA for Your App's Users

Base44 added a setting that lets app owners require multi-factor authentication (MFA) for the people who sign in to their apps. After a password or social login, each user must also enter a one-time code. A stolen password alone is no longer enough to get in. The feature needs the Builder plan or higher.

How the Sign-In Flow Works

Users can verify with an authenticator app such as Google Authenticator or Duo by scanning a QR code. They can also enter a phone number and receive codes by text message. Text codes use the workspace's integration credits, while authenticator apps use none.

MFA applies to everyone who signs in with email and password, Google, Microsoft, Facebook or Apple, including app admins. It cannot be made optional for some users. People who sign in through SSO skip the prompt, because their identity provider handles MFA.

On the first sign-in after MFA is enabled, users set up their method. On later sign-ins they enter a code, and they can choose to skip the code on that device for 30 days.

Turning It On

MFA is off by default. Owners enable it from Dashboard, then Settings, then Authentication. They turn on Require MFA under the Multi-factor authentication section and confirm in a dialog. It takes effect at each user's next sign-in, and anyone already signed in stays signed in until their session ends. Turning it off stops the prompt immediately, and users' saved authenticator apps and phone numbers are kept in case it is turned on again.

Apps with custom login pages must be updated before MFA is enabled, or users cannot sign in. Owners can ask the AI chat to update the sign-in and register pages for MFA and then publish. Apps using the built-in login need no changes.

Resetting a User's MFA

Users do not receive recovery codes. When someone loses their phone or cannot get a code, an owner resets their MFA from Dashboard, then App Users, then the More actions icon, then Reset MFA. A reset removes the user's authenticator app and phone number, signs them out on every device and emails them a notice. They set up MFA again on their next sign-in.

Limits

  • A person cannot reset their own MFA. Another collaborator with edit access must do it.
  • The reset option does not appear for people who have not accepted their invite.
  • MFA applies to all eligible users at once, and individuals cannot be exempted except through SSO.
  • If a workspace later drops to a lower plan, the app keeps requiring MFA, and the owner can still turn it off.