From 991094df10175600b3a7058f174c2eed7cea59c8 Mon Sep 17 00:00:00 2001
From: Rechner Fox <659028+rechner@users.noreply.github.com>
Date: Sat, 19 Sep 2026 12:48:11 -0700
Subject: [PATCH 1/9] feat(auth): Add MFA with Django-Allauth

- Add MFA policy enforcement for admin users with config toggle
- Integrate django-allauth for headless authentication with JWT tokens
- TOTP, WebAuthn, and recovery code MFA methods
- Create MFA setup allowed paths for first enrollment
- Update frontend authentication flow with MFA-aware login component
- Enable passkey-based login with MFA as optional verification layer
---
 memberportal/api_general/tests/__init__.py    |   0
 memberportal/api_general/tests/test_mfa.py    | 237 +++++++++
 memberportal/api_general/urls.py              |  12 +-
 memberportal/api_general/views.py             |  37 ++
 memberportal/membermatters/adapters.py        |  19 +
 memberportal/membermatters/authentication.py  |  26 +
 .../membermatters/constance_config.py         |   5 +
 memberportal/membermatters/mfa_policy.py      | 129 +++++
 memberportal/membermatters/settings.py        |  31 +-
 memberportal/membermatters/token_views.py     |  51 ++
 memberportal/membermatters/urls.py            |   1 +
 memberportal/pyproject.toml                   |   1 +
 memberportal/uv.lock                          |  62 +++
 src-frontend/quasar.config.js                 |   4 +
 src-frontend/src/App.vue                      |  26 +-
 src-frontend/src/components/LoginCard.vue     | 487 +++++++++++++++---
 src-frontend/src/i18n/en-AU/index.ts          |  10 +
 src-frontend/src/i18n/sv-SE/index.ts          |  11 +
 src-frontend/src/pages/Logout.vue             |  29 +-
 19 files changed, 1096 insertions(+), 82 deletions(-)
 create mode 100644 memberportal/api_general/tests/__init__.py
 create mode 100644 memberportal/api_general/tests/test_mfa.py
 create mode 100644 memberportal/membermatters/adapters.py
 create mode 100644 memberportal/membermatters/authentication.py
 create mode 100644 memberportal/membermatters/mfa_policy.py
 create mode 100644 memberportal/membermatters/token_views.py

diff --git a/memberportal/api_general/tests/__init__.py b/memberportal/api_general/tests/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/memberportal/api_general/tests/test_mfa.py b/memberportal/api_general/tests/test_mfa.py
new file mode 100644
index 00000000..bb1ab11a
--- /dev/null
+++ b/memberportal/api_general/tests/test_mfa.py
@@ -0,0 +1,237 @@
+from django.conf import settings
+from django.contrib.auth import user_logged_out
+from django.http import HttpResponse
+from django.test import RequestFactory, TestCase
+from django.urls import resolve
+from django.contrib.sessions.middleware import SessionMiddleware
+from rest_framework import status
+from rest_framework.test import APIClient
+from rest_framework_simplejwt.tokens import RefreshToken
+
+from allauth.mfa.models import Authenticator
+from allauth.mfa.signals import authenticator_used
+from constance.test.unittest import override_config
+
+from membermatters.mfa_policy import (
+    ALLAUTH_PREFIX,
+    MFA_SESSION_KEY,
+    MFA_SETUP_ALLOWED_PATHS,
+    AdminMFAMiddleware,
+    admin_mfa_required,
+    request_has_verified_mfa,
+)
+from profile.models import User
+
+
+class MFAUserTestMixin:
+    def make_user(self, email, staff=False):
+        user = User.objects.create_user(email, password="test-password")
+        if staff:
+            user.staff = True
+            user.save(update_fields=["staff"])
+        return user
+
+
+class AllAuthConfigurationTests(TestCase):
+    def test_headless_mfa_and_passkey_routes_are_available(self):
+        self.assertTrue(settings.HEADLESS_ONLY)
+        self.assertEqual(settings.HEADLESS_CLIENTS, ("browser", "app"))
+        self.assertEqual(
+            settings.HEADLESS_TOKEN_STRATEGY,
+            "allauth.headless.tokens.strategies.jwt.JWTTokenStrategy",
+        )
+        self.assertCountEqual(
+            settings.MFA_SUPPORTED_TYPES,
+            ["totp", "webauthn", "recovery_codes"],
+        )
+        self.assertTrue(settings.MFA_PASSKEY_LOGIN_ENABLED)
+        self.assertFalse(settings.MFA_TRUST_ENABLED)
+
+        expected_routes = (
+            ("/_allauth/browser/v1/auth/login", "login"),
+            ("/_allauth/app/v1/auth/login", "login"),
+            ("/_allauth/browser/v1/config", "config"),
+            (
+                "/_allauth/browser/v1/account/authenticators/totp",
+                "manage_totp",
+            ),
+            (
+                "/_allauth/app/v1/auth/webauthn/login",
+                "login_webauthn",
+            ),
+        )
+        for path, url_name in expected_routes:
+            with self.subTest(path=path):
+                self.assertEqual(resolve(path).url_name, url_name)
+
+
+class MFAAuthenticationPolicyTests(MFAUserTestMixin, TestCase):
+    def request_with_session(self, path, method="get"):
+        request = getattr(RequestFactory(), method)(path)
+        SessionMiddleware(lambda _: HttpResponse()).process_request(request)
+        request.session.save()
+        return request
+
+    def test_admin_mfa_required_only_matches_staff_when_enabled(self):
+        staff = self.make_user("mfa-staff@example.test", staff=True)
+        member = self.make_user("mfa-member@example.test")
+
+        self.assertFalse(admin_mfa_required(staff))
+        with override_config(ENFORCE_MFA_FOR_ADMIN_USERS=True):
+            self.assertTrue(admin_mfa_required(staff))
+            self.assertFalse(admin_mfa_required(member))
+            self.assertFalse(admin_mfa_required(User()))
+
+    def test_middleware_blocks_unverified_staff_requests(self):
+        staff = self.make_user("middleware-staff@example.test", staff=True)
+        request = self.request_with_session("/api/profile/")
+        request.user = staff
+
+        with override_config(ENFORCE_MFA_FOR_ADMIN_USERS=True):
+            response = AdminMFAMiddleware(lambda _: HttpResponse()).process_view(
+                request, None, (), {}
+            )
+
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+        self.assertEqual(
+            response.content,
+            b'{"code": "mfa_required", "detail": "Complete MFA before accessing this account."}',
+        )
+
+    def test_middleware_allows_setup_paths_and_completed_sessions(self):
+        staff = self.make_user("middleware-allowed@example.test", staff=True)
+        middleware = AdminMFAMiddleware(lambda _: HttpResponse())
+
+        with override_config(ENFORCE_MFA_FOR_ADMIN_USERS=True):
+            for path in MFA_SETUP_ALLOWED_PATHS | {
+                f"{ALLAUTH_PREFIX}browser/v1/auth/login"
+            }:
+                with self.subTest(path=path):
+                    request = self.request_with_session(path)
+                    request.user = staff
+                    self.assertIsNone(middleware.process_view(request, None, (), {}))
+
+            request = self.request_with_session("/api/profile/")
+            request.user = staff
+            request.session[MFA_SESSION_KEY] = str(staff.pk)
+            self.assertIsNone(middleware.process_view(request, None, (), {}))
+
+    def test_middleware_does_not_block_non_staff_or_options(self):
+        member = self.make_user("middleware-member@example.test")
+        middleware = AdminMFAMiddleware(lambda _: HttpResponse())
+
+        with override_config(ENFORCE_MFA_FOR_ADMIN_USERS=True):
+            request = self.request_with_session("/api/profile/")
+            request.user = member
+            self.assertIsNone(middleware.process_view(request, None, (), {}))
+
+            request = self.request_with_session("/api/profile/", method="options")
+            request.user = member
+            self.assertIsNone(middleware.process_view(request, None, (), {}))
+
+    def test_mfa_signal_marks_and_logout_clears_session(self):
+        user = self.make_user("mfa-signals@example.test")
+        request = self.request_with_session("/api/profile/")
+
+        authenticator_used.send(
+            sender=Authenticator,
+            request=request,
+            user=user,
+            authenticator=None,
+        )
+        self.assertEqual(request.session[MFA_SESSION_KEY], str(user.pk))
+        self.assertTrue(request.session.modified)
+        self.assertTrue(request_has_verified_mfa(request, user))
+
+        user_logged_out.send(sender=None, request=request, user=user)
+        self.assertNotIn(MFA_SESSION_KEY, request.session)
+        self.assertFalse(request_has_verified_mfa(request, user))
+
+    def test_token_session_marker_is_accepted(self):
+        user = self.make_user("mfa-token-session@example.test")
+        token_session = self.request_with_session("/api/profile/").session
+        token_session[MFA_SESSION_KEY] = str(user.pk)
+        token_session.save()
+
+        request = self.request_with_session("/api/profile/")
+        request.auth = {"sid": token_session.session_key}
+        self.assertTrue(request_has_verified_mfa(request, user))
+
+    def test_successful_enrollment_marks_the_current_session(self):
+        user = self.make_user("mfa-enrollment@example.test")
+        middleware = AdminMFAMiddleware(lambda _: HttpResponse())
+
+        for path in (
+            "/_allauth/browser/v1/account/authenticators/totp",
+            "/_allauth/app/v1/account/authenticators/webauthn",
+        ):
+            with self.subTest(path=path):
+                request = self.request_with_session(path, method="post")
+                request.user = user
+                middleware.process_response(request, HttpResponse(status=200))
+                self.assertEqual(request.session[MFA_SESSION_KEY], str(user.pk))
+
+        request = self.request_with_session(
+            "/_allauth/browser/v1/account/authenticators/totp", method="post"
+        )
+        request.user = user
+        middleware.process_response(request, HttpResponse(status=400))
+        self.assertNotIn(MFA_SESSION_KEY, request.session)
+
+
+class LegacyTokenMFAEnforcementTests(MFAUserTestMixin, TestCase):
+    def test_staff_obtain_and_refresh_are_blocked_when_mfa_is_enforced(self):
+        user = self.make_user("token-staff@example.test", staff=True)
+        client = APIClient()
+
+        with override_config(ENFORCE_MFA_FOR_ADMIN_USERS=True):
+            obtain = client.post(
+                "/api/token/obtain/",
+                {"email": user.email, "password": "test-password"},
+                format="json",
+            )
+            refresh = client.post(
+                "/api/token/refresh/",
+                {"refresh": str(RefreshToken.for_user(user))},
+                format="json",
+            )
+
+        for response in (obtain, refresh):
+            with self.subTest(response=response):
+                self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+                self.assertEqual(response.json()["code"], "mfa_required")
+
+    def test_non_staff_tokens_continue_to_work_when_enforcement_is_enabled(self):
+        user = self.make_user("token-member@example.test")
+        client = APIClient()
+
+        with override_config(ENFORCE_MFA_FOR_ADMIN_USERS=True):
+            obtain = client.post(
+                "/api/token/obtain/",
+                {"email": user.email, "password": "test-password"},
+                format="json",
+            )
+            refresh = client.post(
+                "/api/token/refresh/",
+                {"refresh": obtain.json()["refresh"]},
+                format="json",
+            )
+
+        self.assertEqual(obtain.status_code, status.HTTP_200_OK)
+        self.assertIn("access", obtain.json())
+        self.assertEqual(refresh.status_code, status.HTTP_200_OK)
+        self.assertIn("access", refresh.json())
+
+    def test_staff_tokens_work_when_enforcement_is_disabled(self):
+        user = self.make_user("token-disabled@example.test", staff=True)
+        client = APIClient()
+
+        with override_config(ENFORCE_MFA_FOR_ADMIN_USERS=False):
+            response = client.post(
+                "/api/token/obtain/",
+                {"email": user.email, "password": "test-password"},
+                format="json",
+            )
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertIn("access", response.json())
diff --git a/memberportal/api_general/urls.py b/memberportal/api_general/urls.py
index 32f69459..bc4cff91 100644
--- a/memberportal/api_general/urls.py
+++ b/memberportal/api_general/urls.py
@@ -1,16 +1,22 @@
 from django.urls import path
-from rest_framework_simplejwt import views as jwt_views
+from membermatters.token_views import (
+    StaffMFAEnforcedTokenObtainPairView,
+    StaffMFAEnforcedTokenRefreshView,
+)
+from django.urls import path
 from . import views
 
 urlpatterns = [
     path("api/config/", views.GetConfig.as_view(), name="get_config"),
     path(
         "api/token/obtain/",
-        jwt_views.TokenObtainPairView.as_view(),
+        StaffMFAEnforcedTokenObtainPairView.as_view(),
         name="token_create",
     ),
     path(
-        "api/token/refresh/", jwt_views.TokenRefreshView.as_view(), name="token_refresh"
+        "api/token/refresh/",
+        StaffMFAEnforcedTokenRefreshView.as_view(),
+        name="token_refresh",
     ),
     path("api/login/", views.Login.as_view(), name="login"),
     path("api/loggedin/", views.LoggedIn.as_view(), name="loggedin"),
diff --git a/memberportal/api_general/views.py b/memberportal/api_general/views.py
index cf1b6197..f415036d 100644
--- a/memberportal/api_general/views.py
+++ b/memberportal/api_general/views.py
@@ -238,6 +238,19 @@ def post(self, request):
 
         # correct login details
         if user is not None:
+            # Enforced staff users must use AllAuth so its MFA stage cannot be
+            # bypassed by the legacy custom login endpoint.
+            from membermatters.mfa_policy import admin_mfa_required
+
+            if admin_mfa_required(user):
+                return Response(
+                    {
+                        "code": "mfa_required",
+                        "detail": "Use the AllAuth login endpoint to complete MFA.",
+                    },
+                    status=status.HTTP_403_FORBIDDEN,
+                )
+
             # if their email is verified
             if user.email_verified:
                 login(request, user)
@@ -334,6 +347,19 @@ def post(self, request):
                 {"message": "error.emailNotVerified"}, status=status.HTTP_403_FORBIDDEN
             )
 
+        # RFID login is a single factor and should not satisfy enforced staff MFA.
+        # We might consider adding a PIN for this usecase?
+        from membermatters.mfa_policy import admin_mfa_required
+
+        if admin_mfa_required(user):
+            return Response(
+                {
+                    "code": "mfa_required",
+                    "detail": "Staff users must use AllAuth MFA login.",
+                },
+                status=status.HTTP_403_FORBIDDEN,
+            )
+
         # rfid matches a user so log them in
         if user is not None:
             login(request, user)
@@ -1205,6 +1231,17 @@ def post(self, request, verify_token):
                 user.save(update_fields=["email_verified"])
 
         if is_fresh:
+            from membermatters.mfa_policy import admin_mfa_required
+
+            if admin_mfa_required(user):
+                return Response(
+                    {
+                        "code": "mfa_required",
+                        "detail": "Use the AllAuth login endpoint to complete MFA.",
+                    },
+                    status=status.HTTP_403_FORBIDDEN,
+                )
+
             # Session login runs after the DB commit so a session-store
             # write cannot extend the transaction's row-lock window.
             login(request, user)
diff --git a/memberportal/membermatters/adapters.py b/memberportal/membermatters/adapters.py
new file mode 100644
index 00000000..31196b2d
--- /dev/null
+++ b/memberportal/membermatters/adapters.py
@@ -0,0 +1,19 @@
+from allauth.account.adapter import DefaultAccountAdapter
+
+
+class MemberMattersAccountAdapter(DefaultAccountAdapter):
+    """Adapt AllAuth account flows to MemberMatters' existing signup flow."""
+
+    def is_open_for_signup(self, request):
+        # Registration remains owned by api_general.Register, which also
+        # creates the required MemberMatters Profile and sends its emails.
+        return False
+
+    def get_user_display(self, user):
+        return user.email
+
+    def authenticate(self, request, **credentials):
+        user = super().authenticate(request, **credentials)
+        if user is not None and not getattr(user, "email_verified", True):
+            return None
+        return user
diff --git a/memberportal/membermatters/authentication.py b/memberportal/membermatters/authentication.py
new file mode 100644
index 00000000..21d13751
--- /dev/null
+++ b/memberportal/membermatters/authentication.py
@@ -0,0 +1,26 @@
+from django.http import HttpRequest
+from rest_framework.authentication import BaseAuthentication
+from rest_framework.exceptions import AuthenticationFailed
+from rest_framework_simplejwt.authentication import JWTAuthentication
+
+from allauth.headless.contrib.rest_framework.authentication import (
+    JWTTokenAuthentication,
+)
+
+
+class HybridJWTAuthentication(BaseAuthentication):
+    """Accept AllAuth JWTs and legacy Simple JWTs during the migration."""
+
+    def authenticate(self, request: HttpRequest):
+        if not request.headers.get("Authorization"):
+            return None
+
+        try:
+            result = JWTTokenAuthentication().authenticate(request)
+        except AuthenticationFailed:
+            result = None
+
+        if result is not None:
+            return result
+
+        return JWTAuthentication().authenticate(request)
diff --git a/memberportal/membermatters/constance_config.py b/memberportal/membermatters/constance_config.py
index 23ec482a..b2dc37b1 100644
--- a/memberportal/membermatters/constance_config.py
+++ b/memberportal/membermatters/constance_config.py
@@ -20,6 +20,10 @@
         "",
         "A site wide banner that can display useful information. Leave empty to turn off.",
     ),
+    "ENFORCE_MFA_FOR_ADMIN_USERS": (
+        False,
+        "Require completed MFA for all staff users before allowing portal or Django admin access.",
+    ),
     # Email config
     "EMAIL_SYSADMIN": (
         "example@example.com",
@@ -603,6 +607,7 @@
                 "ENABLE_RECENT_SWIPES_PAGE",
             ),
         ),
+        ("Security", ("ENFORCE_MFA_FOR_ADMIN_USERS",)),
         ("Stats Settings", ("ENABLE_STATS_PAGE", "STATS_MAX_DAYS", "METRICS_API_KEY")),
         (
             "Sentry Error Reporting",
diff --git a/memberportal/membermatters/mfa_policy.py b/memberportal/membermatters/mfa_policy.py
new file mode 100644
index 00000000..c0664500
--- /dev/null
+++ b/memberportal/membermatters/mfa_policy.py
@@ -0,0 +1,129 @@
+from __future__ import annotations
+
+from django.conf import settings
+from django.contrib.auth.signals import user_logged_out
+from django.http import HttpRequest, JsonResponse
+from django.utils.deprecation import MiddlewareMixin
+from django.dispatch import receiver
+from django.utils.module_loading import import_string
+
+from allauth.mfa.signals import authenticator_used
+from constance import config
+
+MFA_SESSION_KEY = "membermatters.mfa_verified_user"
+ALLAUTH_PREFIX = "/_allauth/"
+MFA_SETUP_ALLOWED_PATHS = {
+    "/api/logout/",
+    "/api/config/",
+    "/api/login/",
+    "/api/token/obtain/",
+    "/api/token/refresh/",
+}
+
+
+def admin_mfa_required(user) -> bool:
+    return bool(
+        getattr(user, "is_authenticated", False)
+        and getattr(user, "is_staff", False)
+        and config.ENFORCE_MFA_FOR_ADMIN_USERS
+    )
+
+
+def _session_has_mfa_marker(session, user) -> bool:
+    return str(session.get(MFA_SESSION_KEY, "")) == str(user.pk)
+
+
+def _session_for_token(request: HttpRequest):
+    auth = getattr(request, "auth", None)
+    candidates = [auth]
+    if isinstance(auth, tuple):
+        candidates.extend(auth)
+    for candidate in candidates:
+        if not isinstance(candidate, dict):
+            continue
+        session_id = candidate.get("sid")
+        if not session_id:
+            continue
+        session_store = import_string(settings.SESSION_ENGINE + ".SessionStore")
+        return session_store(session_key=session_id)
+    return None
+
+
+def request_has_verified_mfa(request: HttpRequest, user) -> bool:
+    if _session_has_mfa_marker(request.session, user):
+        return True
+
+    token_session = _session_for_token(request)
+    return bool(token_session and _session_has_mfa_marker(token_session, user))
+
+
+@receiver(authenticator_used)
+def mark_mfa_session(sender, request, user, **kwargs):
+    if request is not None and user is not None:
+        request.session[MFA_SESSION_KEY] = str(user.pk)
+        request.session.modified = True
+
+
+@receiver(user_logged_out)
+def clear_mfa_session(sender, request, user, **kwargs):
+    if request is not None:
+        request.session.pop(MFA_SESSION_KEY, None)
+
+
+class AdminMFAMiddleware(MiddlewareMixin):
+    """Require completed AllAuth MFA for staff when the flag is enabled."""
+
+    def process_view(self, request, view_func, view_args, view_kwargs):
+        if request.method == "OPTIONS":
+            return None
+
+        if request.path.startswith(ALLAUTH_PREFIX):
+            # AllAuth needs these endpoints to remain available for first-time
+            # enrollment when a staff member has no authenticator yet.
+            return None
+
+        user = request.user
+        if not user.is_authenticated:
+            try:
+                from membermatters.authentication import HybridJWTAuthentication
+
+                authentication = HybridJWTAuthentication().authenticate(request)
+                if authentication:
+                    user, request.auth = authentication
+                    request.user = user
+            except Exception:
+                user = request.user
+
+        if not admin_mfa_required(user):
+            return None
+
+        if request.path in MFA_SETUP_ALLOWED_PATHS:
+            return None
+
+        if request_has_verified_mfa(request, user):
+            return None
+
+        return JsonResponse(
+            {
+                "code": "mfa_required",
+                "detail": "Complete MFA before accessing this account.",
+            },
+            status=403,
+        )
+
+    def process_response(self, request, response):
+        if (
+            request.path.startswith(ALLAUTH_PREFIX)
+            and request.method == "POST"
+            and (
+                request.path.endswith("/account/authenticators/totp")
+                or request.path.endswith("/account/authenticators/webauthn")
+            )
+            and response.status_code < 300
+            and getattr(request.user, "is_authenticated", False)
+        ):
+            # Enrollment verifies the TOTP code or WebAuthn assertion. Treat
+            # that successful ceremony as MFA completion for this session.
+            request.session[MFA_SESSION_KEY] = str(request.user.pk)
+            request.session.modified = True
+        return response
diff --git a/memberportal/membermatters/settings.py b/memberportal/membermatters/settings.py
index ea4c6742..c079a647 100644
--- a/memberportal/membermatters/settings.py
+++ b/memberportal/membermatters/settings.py
@@ -93,6 +93,10 @@
     "django.contrib.admin",
     "django.contrib.auth",
     "django.contrib.contenttypes",
+    "allauth",
+    "allauth.account",
+    "allauth.mfa",
+    "allauth.headless",
     "django.contrib.sessions",
     "django.contrib.messages",
     "django.contrib.staticfiles",
@@ -126,6 +130,8 @@
     "django.middleware.common.CommonMiddleware",
     "django.middleware.csrf.CsrfViewMiddleware",
     "django.contrib.auth.middleware.AuthenticationMiddleware",
+    "allauth.account.middleware.AccountMiddleware",
+    "membermatters.mfa_policy.AdminMFAMiddleware",
     "django.contrib.messages.middleware.MessageMiddleware",
     "django.middleware.clickjacking.XFrameOptionsMiddleware",
     "membermatters.middleware.Sentry",
@@ -383,7 +389,7 @@
     "DEFAULT_PERMISSION_CLASSES": ("rest_framework.permissions.IsAuthenticated",),
     "DEFAULT_AUTHENTICATION_CLASSES": (
         "rest_framework.authentication.SessionAuthentication",
-        "rest_framework_simplejwt.authentication.JWTAuthentication",
+        "membermatters.authentication.HybridJWTAuthentication",
     ),
     "DEFAULT_THROTTLE_CLASSES": ("rest_framework.throttling.ScopedRateThrottle",),
     "NUM_PROXIES": int(_num_proxies) if _num_proxies else None,
@@ -437,6 +443,29 @@
 
 AUTH_USER_MODEL = "profile.User"
 
+# Django-AllAuth is used in headless mode by the Vue SPA. Existing custom
+# registration and password-reset APIs remain the source of truth.
+AUTHENTICATION_BACKENDS = ("allauth.account.auth_backends.AuthenticationBackend",)
+ACCOUNT_ADAPTER = "membermatters.adapters.MemberMattersAccountAdapter"
+ACCOUNT_USER_MODEL_USERNAME_FIELD = None
+ACCOUNT_USER_MODEL_EMAIL_FIELD = "email"
+ACCOUNT_LOGIN_METHODS = {"email"}
+ACCOUNT_SIGNUP_FIELDS = ["email*", "password1*", "password2*"]
+ACCOUNT_EMAIL_VERIFICATION = "none"
+ACCOUNT_LOGIN_TIMEOUT = 900
+
+HEADLESS_ONLY = True
+HEADLESS_CLIENTS = ("browser", "app")
+HEADLESS_TOKEN_STRATEGY = "allauth.headless.tokens.strategies.jwt.JWTTokenStrategy"
+HEADLESS_JWT_AUTHORIZATION_HEADER_SCHEME = "Bearer"
+
+MFA_SUPPORTED_TYPES = ["totp", "webauthn", "recovery_codes"]
+MFA_PASSKEY_LOGIN_ENABLED = True
+MFA_RECOVERY_CODES_SHOW_ONCE = True
+MFA_TOTP_ISSUER = "MemberMatters"
+MFA_WEBAUTHN_ALLOW_INSECURE_ORIGIN = DEBUG
+MFA_TRUST_ENABLED = False
+
 REQUEST_TIMEOUT = 0.05
 
 # Celery configuration
diff --git a/memberportal/membermatters/token_views.py b/memberportal/membermatters/token_views.py
new file mode 100644
index 00000000..6a4a8ec7
--- /dev/null
+++ b/memberportal/membermatters/token_views.py
@@ -0,0 +1,51 @@
+from django.conf import settings
+from django.contrib.auth import get_user_model
+from rest_framework import status
+from rest_framework.response import Response
+from rest_framework_simplejwt.tokens import RefreshToken
+from rest_framework_simplejwt.views import TokenObtainPairView, TokenRefreshView
+
+
+class StaffMFAEnforcedTokenObtainPairView(TokenObtainPairView):
+    """Prevent the legacy JWT endpoint from bypassing enforced staff MFA."""
+
+    def post(self, request, *args, **kwargs):
+        serializer = self.get_serializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+
+        from membermatters.mfa_policy import admin_mfa_required
+
+        if admin_mfa_required(serializer.user):
+            return Response(
+                {
+                    "code": "mfa_required",
+                    "detail": "Use the AllAuth login endpoint to complete MFA.",
+                },
+                status=status.HTTP_403_FORBIDDEN,
+            )
+
+        return Response(serializer.validated_data, status=status.HTTP_200_OK)
+
+
+class StaffMFAEnforcedTokenRefreshView(TokenRefreshView):
+    """Prevent legacy refresh tokens from bypassing enforced staff MFA."""
+
+    def post(self, request, *args, **kwargs):
+        serializer = self.get_serializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+
+        from membermatters.mfa_policy import admin_mfa_required
+
+        refresh = RefreshToken(request.data["refresh"])
+        user_id = refresh.get(settings.SIMPLE_JWT["USER_ID_CLAIM"])
+        user = get_user_model().objects.filter(pk=user_id).first()
+        if admin_mfa_required(user):
+            return Response(
+                {
+                    "code": "mfa_required",
+                    "detail": "Use the AllAuth login endpoint to complete MFA.",
+                },
+                status=status.HTTP_403_FORBIDDEN,
+            )
+
+        return Response(serializer.validated_data, status=status.HTTP_200_OK)
diff --git a/memberportal/membermatters/urls.py b/memberportal/membermatters/urls.py
index 2d3b8fb0..11ec21ad 100644
--- a/memberportal/membermatters/urls.py
+++ b/memberportal/membermatters/urls.py
@@ -14,6 +14,7 @@ def safe_constance_get(fld: str):
 
 
 urlpatterns = [
+    path("_allauth/", include("allauth.headless.urls")),
     path("api/openid/", include("oidc_provider.urls", namespace="oidc_provider")),
     path("", include("api_metrics.urls")),
     path("", include("api_spacedirectory.urls")),
diff --git a/memberportal/pyproject.toml b/memberportal/pyproject.toml
index b95421d6..6d383456 100644
--- a/memberportal/pyproject.toml
+++ b/memberportal/pyproject.toml
@@ -55,6 +55,7 @@ dependencies = [
     "nh3~=0.3.5",
     "pillow>=12,<13",
     "docuseal~=1.0.9",
+    "django-allauth[headless,mfa]>=65,<66",
 ]
 
 [dependency-groups]
diff --git a/memberportal/uv.lock b/memberportal/uv.lock
index 30e3bf80..16994d1d 100644
--- a/memberportal/uv.lock
+++ b/memberportal/uv.lock
@@ -453,6 +453,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/52/40/9d857001228658f0d59e97ebd4c346fe73e138c6de1bce61dc568a57c7f8/click_repl-0.3.0-py3-none-any.whl", hash = "sha256:fb7e06deb8da8de86180a33a9da97ac316751c094c6899382da7feeeeb51b812", size = 10289, upload-time = "2023-06-15T12:43:48.626Z" },
 ]
 
+[[package]]
+name = "colorama"
+version = "0.4.6"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d8/53/6f443c9a4a8358a93a6792e2acffb9d9d5cb0a5cfd8802644b7b1c9a02e4/colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44", size = 27697, upload-time = "2022-10-25T02:36:22.414Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" },
+]
+
 [[package]]
 name = "constantly"
 version = "23.10.4"
@@ -607,6 +616,28 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/2e/b4/23e74d261eebfa9c8baed5e8810f09858b9afd613d1037f42ff7aa95c87f/django-6.0.8-py3-none-any.whl", hash = "sha256:9b98b7e1902e0e575ea4f42c175fc9512784f7f2580898286aee3388b322219d", size = 8376956, upload-time = "2026-08-04T15:03:35.138Z" },
 ]
 
+[[package]]
+name = "django-allauth"
+version = "65.19.4"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "asgiref" },
+    { name = "django" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/c2/2c/4c7a046f363396093d825df208d1b621ec9591ac30ea4657c26cda5f549c/django_allauth-65.19.4.tar.gz", hash = "sha256:7ea5f0057f91fa25f9ca7814f84aed63a66096b43df073fbdf1ef0167bc92f1d", size = 2293509, upload-time = "2026-09-17T13:29:20.775Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/53/04/7e47e7f33c25f1edbc5d5278fc4cdf1875399eecdcb36b5588c53550f770/django_allauth-65.19.4-py3-none-any.whl", hash = "sha256:a4f13476ad460ab1098af6be41ae72ed1d07498dd4514e05b9daef09a6c1cabd", size = 2075786, upload-time = "2026-09-17T13:27:51.745Z" },
+]
+
+[package.optional-dependencies]
+headless = [
+    { name = "pyjwt", extra = ["crypto"] },
+]
+mfa = [
+    { name = "fido2" },
+    { name = "qrcode" },
+]
+
 [[package]]
 name = "django-celery-beat"
 version = "2.9.0"
@@ -783,6 +814,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/cd/2a/33d635fb5e70f5b837046abefd173087cdbf60c2f831813a48544ce7ee68/docuseal-1.0.9-py3-none-any.whl", hash = "sha256:99ab08e31e29b597873fbb675082877e71bc2c0dcf0610a4b559dc276297cf19", size = 7421, upload-time = "2026-07-17T14:16:29.604Z" },
 ]
 
+[[package]]
+name = "fido2"
+version = "2.2.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cryptography" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/ba/ea/6f08c354b7aeb8019249d46a86c2153f8218499cced4d21bf16b6d49fc16/fido2-2.2.1.tar.gz", hash = "sha256:85787428a94c3f8eaf72f0ff30afba983b559a1b1b795c93318c81b4ad4062c4", size = 327147, upload-time = "2026-06-29T17:41:11.927Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/71/84/198d99c3312557ef6121cf78c38281efe9b3bc88cba0e2c05446f38a024d/fido2-2.2.1-py3-none-any.whl", hash = "sha256:ed397da981b9ab133da6ead7309e41f924b566b749956129efe286fae097749f", size = 238354, upload-time = "2026-06-29T17:41:09.921Z" },
+]
+
 [[package]]
 name = "filelock"
 version = "3.32.7"
@@ -984,6 +1027,7 @@ dependencies = [
     { name = "channels-redis" },
     { name = "daphne" },
     { name = "django" },
+    { name = "django-allauth", extra = ["headless", "mfa"] },
     { name = "django-celery-beat" },
     { name = "django-celery-results" },
     { name = "django-constance" },
@@ -1032,6 +1076,7 @@ requires-dist = [
     { name = "channels-redis", specifier = ">=4.3,<5" },
     { name = "daphne", specifier = ">=4,<5" },
     { name = "django", specifier = ">=6,<6.1" },
+    { name = "django-allauth", extras = ["headless", "mfa"], specifier = ">=65,<66" },
     { name = "django-celery-beat", specifier = ">=2.7,<3" },
     { name = "django-celery-results", specifier = ">=2.6,<3" },
     { name = "django-constance", specifier = ">=4,<5" },
@@ -1411,6 +1456,11 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/9c/97/672cb32ce0dfea44b740cb7b4f97038463b9cf7c0ead1aacf595572851d6/pyjwt-2.14.0-py3-none-any.whl", hash = "sha256:ad0cef71c756a56e74863c2919cf0985f72decbcfcb550ee2f422e7c62b5eedc", size = 32896, upload-time = "2026-09-11T13:11:53.409Z" },
 ]
 
+[package.optional-dependencies]
+crypto = [
+    { name = "cryptography" },
+]
+
 [[package]]
 name = "pyopenssl"
 version = "26.4.0"
@@ -1491,6 +1541,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/f1/12/de94a39c2ef588c7e6455cfbe7343d3b2dc9d6b6b2f40c4c6565744c873d/pyyaml-6.0.3-cp314-cp314t-win_arm64.whl", hash = "sha256:ebc55a14a21cb14062aa4162f906cd962b28e2e9ea38f9b4391244cd8de4ae0b", size = 149341, upload-time = "2025-09-25T21:32:56.828Z" },
 ]
 
+[[package]]
+name = "qrcode"
+version = "8.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/8f/b2/7fc2931bfae0af02d5f53b174e9cf701adbb35f39d69c2af63d4a39f81a9/qrcode-8.2.tar.gz", hash = "sha256:35c3f2a4172b33136ab9f6b3ef1c00260dd2f66f858f24d88418a015f446506c", size = 43317, upload-time = "2025-05-01T15:44:24.726Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/dd/b8/d2d6d731733f51684bbf76bf34dab3b70a9148e8f2cef2bb544fccec681a/qrcode-8.2-py3-none-any.whl", hash = "sha256:16e64e0716c14960108e85d853062c9e8bba5ca8252c0b4d0231b9df4060ff4f", size = 45986, upload-time = "2025-05-01T15:44:22.781Z" },
+]
+
 [[package]]
 name = "redis"
 version = "8.1.0"
diff --git a/src-frontend/quasar.config.js b/src-frontend/quasar.config.js
index be0ec0fe..40736284 100644
--- a/src-frontend/quasar.config.js
+++ b/src-frontend/quasar.config.js
@@ -131,6 +131,10 @@ module.exports = configure(function (ctx) {
           target: 'http://127.0.0.1:8000',
           changeOrigin: false,
         },
+        '/_allauth': {
+          target: 'http://127.0.0.1:8000',
+          changeOrigin: false,
+        },
         '/admin': {
           target: 'http://127.0.0.1:8000',
           changeOrigin: true,
diff --git a/src-frontend/src/App.vue b/src-frontend/src/App.vue
index daa6b13c..6a4bd876 100644
--- a/src-frontend/src/App.vue
+++ b/src-frontend/src/App.vue
@@ -69,17 +69,31 @@ export default defineComponent({
             Platform.is.capacitor &&
             error.response.data?.messages[0]?.token_class === 'AccessToken'
           ) {
-            this.$axios
-              .post('/api/token/refresh/', {
-                refresh: this.refreshToken,
-              })
+            const refreshAllauth = this.$axios.post(
+              '/_allauth/app/v1/tokens/refresh',
+              { refresh_token: this.refreshToken },
+              { headers: { Accept: 'application/json' } },
+            );
+            refreshAllauth
+              .catch(() =>
+                this.$axios.post('/api/token/refresh/', {
+                  refresh: this.refreshToken,
+                }),
+              )
               .then((response) => {
-                this.setAuth(response.data);
+                const tokenData = response.data.data || response.data;
+                this.setAuth({
+                  access: tokenData.access_token || tokenData.access,
+                  refresh:
+                    tokenData.refresh_token ||
+                    tokenData.refresh ||
+                    this.refreshToken,
+                });
                 this.setLoggedIn(true);
                 return Promise.resolve();
               })
               .catch(() => {
-                // if we fail to refresh, send them back to the login page
+                // if both refresh endpoints fail, send them back to login
                 this.$router.push('/login');
                 return Promise.resolve();
               });
diff --git a/src-frontend/src/components/LoginCard.vue b/src-frontend/src/components/LoginCard.vue
index e0384fe0..4d79e273 100644
--- a/src-frontend/src/components/LoginCard.vue
+++ b/src-frontend/src/components/LoginCard.vue
@@ -11,7 +11,7 @@
     </template>
 
     <template v-else>
-      <q-card v-if="!resetToken">
+      <q-card v-if="!resetToken && !mfaSetupRequired">
         <q-img
           v-if="images.siteLogo"
           fit="contain"
@@ -41,6 +41,7 @@
             />
 
             <q-input
+              v-if="!mfaRequired"
               v-model="password"
               id="password-field"
               filled
@@ -54,6 +55,22 @@
               ]"
             />
 
+            <q-input
+              v-if="mfaRequired"
+              v-model="mfaCode"
+              id="mfa-code-field"
+              filled
+              autofocus
+              autocomplete="one-time-code"
+              inputmode="numeric"
+              :label="$t('loginCard.mfaCode')"
+              :rules="[(val) => validateNotEmpty(val)]"
+            />
+
+            <q-banner v-if="mfaRequired" class="bg-info text-white">
+              {{ $t('loginCard.mfaRequired') }}
+            </q-banner>
+
             <q-banner v-if="loginComplete" class="bg-positive text-white">
               {{ $t('loginCard.loginSuccess') }}
             </q-banner>
@@ -92,8 +109,30 @@
                 @click="reset.prompt = true"
               />
               <q-btn
-                :label="$t('loginCard.login')"
-                type="submit"
+                v-if="mfaRequired && mfaTypes.includes('webauthn')"
+                :label="$t('loginCard.usePasskey')"
+                type="button"
+                color="primary"
+                flat
+                :loading="buttonLoading"
+                @click="loginWithPasskey"
+              />
+              <q-btn
+                v-if="!mfaRequired && !discourseSsoData"
+                :label="$t('loginCard.usePasskey')"
+                type="button"
+                color="primary"
+                flat
+                :loading="buttonLoading"
+                @click="loginWithPasskey"
+              />
+              <q-btn
+                :label="
+                  mfaRequired
+                    ? $t('loginCard.verifyMfa')
+                    : $t('loginCard.login')
+                "
+                :type="mfaRequired ? 'submit' : 'submit'"
                 color="primary-btn"
                 :loading="buttonLoading"
               />
@@ -102,6 +141,57 @@
         </q-card-section>
       </q-card>
 
+      <q-card v-else-if="mfaSetupRequired" class="login-card">
+        <h6 class="q-ma-none q-pa-md">
+          {{ $t('loginCard.mfaSetupTitle') }}
+        </h6>
+        <q-card-section>
+          <p>{{ $t('loginCard.mfaSetupDescription') }}</p>
+          <q-img
+            v-if="totpQrCode"
+            :src="totpQrCode"
+            fit="contain"
+            style="max-width: 220px"
+            class="q-mb-md"
+          />
+          <p v-if="totpSecret" class="text-caption">
+            {{ $t('loginCard.mfaSetupSecret') }}: <code>{{ totpSecret }}</code>
+          </p>
+          <q-input
+            v-model="mfaSetupCode"
+            filled
+            autocomplete="one-time-code"
+            inputmode="numeric"
+            :label="$t('loginCard.mfaCode')"
+          />
+          <q-banner v-if="loginError" class="bg-negative text-white q-mt-md">
+            {{ $t('error.requestFailed') }}
+          </q-banner>
+          <div class="row q-mt-md">
+            <q-space />
+            <q-btn
+              :label="$t('loginCard.skipMfaSetup')"
+              flat
+              color="primary"
+              @click="skipMfaSetup"
+            />
+            <q-btn
+              :label="$t('loginCard.usePasskey')"
+              flat
+              color="primary"
+              :loading="buttonLoading"
+              @click="addPasskey"
+            />
+            <q-btn
+              :label="$t('loginCard.enableMfa')"
+              color="primary-btn"
+              :loading="buttonLoading"
+              @click="activateMfa"
+            />
+          </div>
+        </q-card-section>
+      </q-card>
+
       <q-card v-else class="login-card">
         <h6 class="q-ma-none q-pa-md">
           {{ $t('loginCard.resetPassword') }}
@@ -233,6 +323,120 @@ import formMixin from '../mixins/formMixin';
 import { SplashScreen } from '@capacitor/splash-screen';
 import { LocationQuery } from 'vue-router';
 import { defineComponent } from 'vue';
+import QRCode from 'qrcode';
+
+function decodeBase64Url(value: string): ArrayBuffer {
+  const normalized = value.replace(/-/g, '+').replace(/_/g, '/');
+  const padded = normalized + '='.repeat((4 - (normalized.length % 4)) % 4);
+  const bytes = atob(padded);
+  return Uint8Array.from(bytes, (char) => char.charCodeAt(0)).buffer;
+}
+
+function encodeBase64Url(value: ArrayBuffer | null): string | null {
+  if (!value) return null;
+  const bytes = new Uint8Array(value);
+  let binary = '';
+  bytes.forEach((byte) => {
+    binary += String.fromCharCode(byte);
+  });
+  return btoa(binary)
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+}
+
+type WebAuthnCredentialDescriptorJSON = {
+  id: string;
+  transports?: string[];
+};
+
+type WebAuthnRequestOptionsJSON = {
+  challenge: string;
+  allowCredentials?: WebAuthnCredentialDescriptorJSON[];
+  allow_credentials?: WebAuthnCredentialDescriptorJSON[];
+  userVerification?: string;
+  user_verification?: string;
+  [key: string]: unknown;
+};
+
+function parseWebAuthnRequestOptions(
+  options: WebAuthnRequestOptionsJSON,
+): PublicKeyCredentialRequestOptions {
+  const parsed = { ...options };
+  parsed.challenge = decodeBase64Url(parsed.challenge);
+  const credentials = parsed.allowCredentials || parsed.allow_credentials;
+  if (credentials) {
+    parsed.allowCredentials = credentials.map((credential) => ({
+      ...credential,
+      id: decodeBase64Url(credential.id),
+      transports: credential.transports as AuthenticatorTransport[] | undefined,
+    }));
+    delete parsed.allow_credentials;
+  }
+  if (parsed.user_verification && !parsed.userVerification) {
+    parsed.userVerification = parsed.user_verification;
+  }
+  delete parsed.user_verification;
+  return parsed as PublicKeyCredentialRequestOptions;
+}
+
+function serializeWebAuthnCredential(
+  credential: PublicKeyCredential,
+): Record<string, unknown> {
+  const response = credential.response as AuthenticatorAssertionResponse;
+  return {
+    id: credential.id,
+    rawId: encodeBase64Url(credential.rawId),
+    type: credential.type,
+    response: {
+      clientDataJSON: encodeBase64Url(response.clientDataJSON),
+      authenticatorData: encodeBase64Url(response.authenticatorData),
+      signature: encodeBase64Url(response.signature),
+      userHandle: encodeBase64Url(response.userHandle),
+    },
+  };
+}
+
+function parseWebAuthnCreationOptions(
+  options: WebAuthnRequestOptionsJSON & {
+    user: { id: string; [key: string]: unknown };
+    excludeCredentials?: WebAuthnCredentialDescriptorJSON[];
+    exclude_credentials?: WebAuthnCredentialDescriptorJSON[];
+  },
+): PublicKeyCredentialCreationOptions {
+  const parsed = { ...options };
+  parsed.challenge = decodeBase64Url(parsed.challenge);
+  parsed.user = {
+    ...parsed.user,
+    id: decodeBase64Url(parsed.user.id),
+  } as unknown as typeof parsed.user;
+  const credentials = parsed.excludeCredentials || parsed.exclude_credentials;
+  if (credentials) {
+    parsed.excludeCredentials = credentials.map((credential) => ({
+      ...credential,
+      id: decodeBase64Url(credential.id),
+      transports: credential.transports as AuthenticatorTransport[] | undefined,
+    }));
+    delete parsed.exclude_credentials;
+  }
+  return parsed as unknown as PublicKeyCredentialCreationOptions;
+}
+
+function serializeWebAuthnCreationCredential(
+  credential: PublicKeyCredential,
+): Record<string, unknown> {
+  const response = credential.response as AuthenticatorAttestationResponse;
+  return {
+    id: credential.id,
+    rawId: encodeBase64Url(credential.rawId),
+    type: credential.type,
+    response: {
+      clientDataJSON: encodeBase64Url(response.clientDataJSON),
+      attestationObject: encodeBase64Url(response.attestationObject),
+      transports: response.getTransports?.(),
+    },
+  };
+}
 
 export default defineComponent({
   name: 'LoginCard',
@@ -255,6 +459,14 @@ export default defineComponent({
       loginFailed: false,
       loginError: false,
       loginComplete: false,
+      mfaRequired: false,
+      mfaCode: '',
+      mfaTypes: [] as string[],
+      mfaSetupRequired: false,
+      mfaSetupCode: '',
+      totpSecret: '',
+      totpQrCode: '',
+      allauthSessionToken: '',
       unverifiedEmail: false,
       buttonLoading: false,
       discourseSsoData: null as LocationQuery | null,
@@ -359,7 +571,11 @@ export default defineComponent({
       this.password = null;
     },
     onSubmit() {
-      this.login();
+      if (this.mfaRequired) {
+        this.completeMfa();
+      } else {
+        this.login();
+      }
     },
     /**
      * This sends the login API request to log the user in.
@@ -377,65 +593,9 @@ export default defineComponent({
             sso: this.discourseSsoData,
           })
           .then((response) => {
-            this.loginFailed = false;
-            this.loginError = false;
             this.loginComplete = true;
-
             window.location = response.data.redirect;
           })
-          .catch((error) => {
-            if (error.response.status === 401) {
-              this.loginFailed = true;
-              this.unverifiedEmail = false;
-            } else if (error.response.status === 403) {
-              this.unverifiedEmail = true;
-              this.loginFailed = false;
-              throw error;
-            } else {
-              this.loginError = true;
-              this.unverifiedEmail = false;
-              throw error;
-            }
-          })
-          .finally(() => {
-            this.buttonLoading = false;
-          });
-      } else if (this.$q.platform.is.capacitor) {
-        this.$axios
-          .post('/api/token/obtain/', {
-            email: this.email,
-            password: this.password,
-          })
-          .then((response) => {
-            this.setAuth(response.data);
-            this.redirectLoggedIn();
-          })
-          .catch((error) => {
-            if (error.response.status === 401) {
-              this.loginFailed = true;
-              this.unverifiedEmail = false;
-            } else if (error.response.status === 403) {
-              this.unverifiedEmail = true;
-              this.loginFailed = false;
-              throw error;
-            } else {
-              this.loginError = true;
-              this.unverifiedEmail = false;
-              throw error;
-            }
-          })
-          .finally(() => {
-            this.buttonLoading = false;
-          });
-      } else {
-        this.$axios
-          .post('/api/login/', {
-            email: this.email,
-            password: this.password,
-          })
-          .then(() => {
-            this.redirectLoggedIn();
-          })
           .catch((error) => {
             if (error.response?.status === 401) {
               this.loginFailed = true;
@@ -443,16 +603,219 @@ export default defineComponent({
             } else if (error.response?.status === 403) {
               this.unverifiedEmail = true;
               this.loginFailed = false;
-              throw error;
             } else {
               this.loginError = true;
               this.unverifiedEmail = false;
-              throw error;
             }
           })
           .finally(() => {
             this.buttonLoading = false;
           });
+        return;
+      }
+
+      this.loginWithAllauth();
+    },
+    allauthClient() {
+      return this.$q.platform.is.capacitor ? 'app' : 'browser';
+    },
+    allauthPath(path) {
+      return `/_allauth/${this.allauthClient()}/v1${path}`;
+    },
+    allauthHeaders() {
+      const headers: Record<string, string> = { Accept: 'application/json' };
+      if (this.allauthClient() === 'app' && this.allauthSessionToken) {
+        headers['X-Session-Token'] = this.allauthSessionToken;
+      }
+      return headers;
+    },
+    saveAllauthTokens(data) {
+      const meta = data?.meta || {};
+      if (meta.session_token) this.allauthSessionToken = meta.session_token;
+      if (meta.access_token) {
+        this.setAuth({
+          access: meta.access_token,
+          refresh: meta.refresh_token || '',
+        });
+      }
+    },
+    setMfaChallenge(data) {
+      const flow = (data?.data?.flows || []).find(
+        (candidate) =>
+          candidate.id === 'mfa_authenticate' && candidate.is_pending,
+      );
+      if (!flow) return false;
+
+      this.mfaRequired = true;
+      this.mfaCode = '';
+      this.mfaTypes = flow.types || ['totp', 'recovery_codes'];
+      return true;
+    },
+    async finishAllauthLogin() {
+      try {
+        const response = await this.$axios.get(
+          this.allauthPath('/account/authenticators'),
+          { headers: this.allauthHeaders() },
+        );
+        this.saveAllauthTokens(response.data);
+        if (response.data.data?.length === 0) {
+          const setupResponse = await this.$axios
+            .get(this.allauthPath('/account/authenticators/totp'), {
+              headers: this.allauthHeaders(),
+            })
+            .catch((error) => error.response);
+          this.saveAllauthTokens(setupResponse?.data);
+          const meta = setupResponse?.data?.meta || {};
+          if (meta.secret && meta.totp_url) {
+            this.totpSecret = meta.secret;
+            this.totpQrCode = await QRCode.toDataURL(meta.totp_url);
+            this.mfaSetupRequired = true;
+            return;
+          }
+        }
+      } catch {
+        // A failed status check should not discard a successful login.
+      }
+      this.redirectLoggedIn();
+    },
+    skipMfaSetup() {
+      this.mfaSetupRequired = false;
+      this.redirectLoggedIn();
+    },
+    async activateMfa() {
+      this.buttonLoading = true;
+      this.loginError = false;
+      try {
+        await this.$axios.post(
+          this.allauthPath('/account/authenticators/totp'),
+          { code: this.mfaSetupCode },
+          { headers: this.allauthHeaders() },
+        );
+        this.mfaSetupRequired = false;
+        this.mfaSetupCode = '';
+        this.redirectLoggedIn();
+      } catch {
+        this.loginError = true;
+      } finally {
+        this.buttonLoading = false;
+      }
+    },
+    async addPasskey() {
+      this.buttonLoading = true;
+      this.loginError = false;
+      try {
+        const optionsResponse = await this.$axios.get(
+          `${this.allauthPath('/account/authenticators/webauthn')}?passwordless`,
+          { headers: this.allauthHeaders() },
+        );
+        const creationOptions = optionsResponse.data.data?.creation_options;
+        const credential = await navigator.credentials.create({
+          publicKey: parseWebAuthnCreationOptions(creationOptions),
+        });
+        if (!credential) throw new Error('Passkey registration was cancelled.');
+        await this.$axios.post(
+          this.allauthPath('/account/authenticators/webauthn'),
+          {
+            name: 'MemberMatters passkey',
+            credential: serializeWebAuthnCreationCredential(
+              credential as PublicKeyCredential,
+            ),
+          },
+          { headers: this.allauthHeaders() },
+        );
+        this.mfaSetupRequired = false;
+        this.finishAllauthLogin();
+      } catch {
+        this.loginError = true;
+      } finally {
+        this.buttonLoading = false;
+      }
+    },
+    async loginWithAllauth() {
+      try {
+        const response = await this.$axios.post(
+          this.allauthPath('/auth/login'),
+          { email: this.email, password: this.password },
+          { headers: this.allauthHeaders() },
+        );
+        this.saveAllauthTokens(response.data);
+        if (response.data.meta?.is_authenticated) {
+          this.finishAllauthLogin();
+        } else if (!this.setMfaChallenge(response.data)) {
+          this.loginError = true;
+        }
+      } catch (error) {
+        this.saveAllauthTokens(error.response?.data);
+        if (!this.setMfaChallenge(error.response?.data)) {
+          if (error.response?.status === 401) {
+            this.loginFailed = true;
+          } else {
+            this.loginError = true;
+          }
+          this.unverifiedEmail = false;
+        }
+      } finally {
+        this.buttonLoading = false;
+      }
+    },
+    async completeMfa() {
+      this.loginFailed = false;
+      this.loginError = false;
+      this.buttonLoading = true;
+      try {
+        const response = await this.$axios.post(
+          this.allauthPath('/auth/2fa/authenticate'),
+          { code: this.mfaCode },
+          { headers: this.allauthHeaders() },
+        );
+        this.saveAllauthTokens(response.data);
+        this.mfaRequired = false;
+        this.finishAllauthLogin();
+      } catch (error) {
+        this.loginFailed = error.response?.status === 400;
+        this.loginError = !this.loginFailed;
+      } finally {
+        this.buttonLoading = false;
+      }
+    },
+    async loginWithPasskey() {
+      this.loginFailed = false;
+      this.loginError = false;
+      this.buttonLoading = true;
+      const loginPath = this.mfaRequired
+        ? '/auth/webauthn/authenticate'
+        : '/auth/webauthn/login';
+      try {
+        const optionsResponse = await this.$axios.get(
+          this.allauthPath(loginPath),
+          { headers: this.allauthHeaders() },
+        );
+        this.saveAllauthTokens(optionsResponse.data);
+        const requestOptions =
+          optionsResponse.data.data?.request_options ||
+          optionsResponse.data.data?.requestOptions;
+        const credential = await navigator.credentials.get({
+          publicKey: parseWebAuthnRequestOptions(requestOptions),
+        });
+        if (!credential)
+          throw new Error('Passkey authentication was cancelled.');
+
+        const response = await this.$axios.post(
+          this.allauthPath(loginPath),
+          {
+            credential: serializeWebAuthnCredential(
+              credential as PublicKeyCredential,
+            ),
+          },
+          { headers: this.allauthHeaders() },
+        );
+        this.saveAllauthTokens(response.data);
+        this.mfaRequired = false;
+        this.finishAllauthLogin();
+      } catch {
+        this.loginError = true;
+      } finally {
+        this.buttonLoading = false;
       }
     },
     /**
diff --git a/src-frontend/src/i18n/en-AU/index.ts b/src-frontend/src/i18n/en-AU/index.ts
index 96e9c1f8..d5973b1f 100644
--- a/src-frontend/src/i18n/en-AU/index.ts
+++ b/src-frontend/src/i18n/en-AU/index.ts
@@ -184,6 +184,16 @@ export default {
     login: 'Login',
     resetPassword: 'Reset Password',
     loginSuccess: 'Login Successful',
+    mfaCode: 'Authentication code',
+    mfaRequired: 'Enter the code from your authenticator app or use a passkey.',
+    verifyMfa: 'Verify',
+    usePasskey: 'Use a passkey',
+    mfaSetupTitle: 'Secure your account',
+    mfaSetupDescription:
+      'Scan this QR code with an authenticator app, then enter the generated code.',
+    mfaSetupSecret: 'Setup key',
+    enableMfa: 'Enable MFA',
+    skipMfaSetup: 'Skip for now',
     registerHere: 'Register Here',
     notAMember: 'Not a member? ',
     loginToContinue: 'Please login to continue',
diff --git a/src-frontend/src/i18n/sv-SE/index.ts b/src-frontend/src/i18n/sv-SE/index.ts
index d0445c1d..d895d7dd 100644
--- a/src-frontend/src/i18n/sv-SE/index.ts
+++ b/src-frontend/src/i18n/sv-SE/index.ts
@@ -177,6 +177,17 @@ export default {
     login: 'Login',
     resetPassword: 'Återställ lösenord',
     loginSuccess: 'Inloggning lyckades',
+    mfaCode: 'Autentiseringskod',
+    mfaRequired:
+      'Ange koden från din autentiseringsapp eller använd en lösenordsnyckel.',
+    verifyMfa: 'Verifiera',
+    usePasskey: 'Använd lösenordsnyckel',
+    mfaSetupTitle: 'Skydda ditt konto',
+    mfaSetupDescription:
+      'Skanna QR-koden med en autentiseringsapp och ange sedan den genererade koden.',
+    mfaSetupSecret: 'Installationsnyckel',
+    enableMfa: 'Aktivera MFA',
+    skipMfaSetup: 'Hoppa över tills vidare',
     registerHere: 'Registrera Här',
     notAMember: 'Inte medlem än? ',
     loginToContinue: 'Logga in för att fortsätta',
diff --git a/src-frontend/src/pages/Logout.vue b/src-frontend/src/pages/Logout.vue
index 19c11090..b859636c 100644
--- a/src-frontend/src/pages/Logout.vue
+++ b/src-frontend/src/pages/Logout.vue
@@ -27,18 +27,27 @@ export default defineComponent({
     };
   },
   mounted() {
-    this.$axios
-      .post('/api/logout/')
-      .then(() => {
+    const logoutRequests = [this.$axios.post('/api/logout/')];
+    if (this.$q.platform.is.capacitor) {
+      logoutRequests.push(
+        this.$axios.delete('/_allauth/app/v1/auth/session', {
+          headers: { Accept: 'application/json' },
+        }),
+      );
+    }
+
+    Promise.allSettled(logoutRequests)
+      .then((responses) => {
+        const failed = responses.find(
+          (response) => response.status === 'rejected',
+        );
+        if (failed && failed.reason?.response?.status !== 401) {
+          throw failed.reason;
+        }
         this.completeLogout();
       })
-      .catch((error) => {
-        if (error.response.status === 401) {
-          this.completeLogout();
-        } else {
-          this.error = true;
-          throw error;
-        }
+      .catch(() => {
+        this.error = true;
       });
   },
   methods: {

From 346f948d08bd4b23e7ce9370ddadf8adc269aa85 Mon Sep 17 00:00:00 2001
From: Rechner Fox <659028+rechner@users.noreply.github.com>
Date: Sat, 19 Sep 2026 12:49:09 -0700
Subject: [PATCH 2/9] Add allauth API route to container nginx configuration

---
 docker/nginx.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker/nginx.conf b/docker/nginx.conf
index 13f4fa60..be65a442 100644
--- a/docker/nginx.conf
+++ b/docker/nginx.conf
@@ -66,7 +66,7 @@ http {
         add_header Cache-Control "public, must-revalidate, proxy-revalidate";
     }
 
-    location ~ ^/(api|admin) {
+    location ~ ^/(_allauth|api|admin) {
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $http_x_real_ip;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

From 42b5e50c1fbbe60bc647b875a11a185ed861df73 Mon Sep 17 00:00:00 2001
From: Rechner Fox <659028+rechner@users.noreply.github.com>
Date: Sat, 19 Sep 2026 22:53:13 -0700
Subject: [PATCH 3/9] feat(auth): Enforce MFA for Discourse SSO login attempts

- Prevent admin users from bypassing MFA through legacy login endpoint during SSO handoff
---
 memberportal/api_general/tests/test_mfa.py | 76 +++++++++++++++++++++-
 memberportal/api_general/views.py          | 23 +++++--
 memberportal/membermatters/mfa_policy.py   |  7 +-
 src-frontend/src/components/LoginCard.vue  | 21 +++++-
 4 files changed, 118 insertions(+), 9 deletions(-)

diff --git a/memberportal/api_general/tests/test_mfa.py b/memberportal/api_general/tests/test_mfa.py
index bb1ab11a..8a5c23da 100644
--- a/memberportal/api_general/tests/test_mfa.py
+++ b/memberportal/api_general/tests/test_mfa.py
@@ -1,3 +1,8 @@
+import base64
+import hashlib
+import hmac
+from urllib.parse import urlencode
+
 from django.conf import settings
 from django.contrib.auth import user_logged_out
 from django.http import HttpResponse
@@ -14,13 +19,14 @@
 
 from membermatters.mfa_policy import (
     ALLAUTH_PREFIX,
+    MFA_LOGIN_PATH,
     MFA_SESSION_KEY,
     MFA_SETUP_ALLOWED_PATHS,
     AdminMFAMiddleware,
     admin_mfa_required,
     request_has_verified_mfa,
 )
-from profile.models import User
+from profile.models import Profile, User
 
 
 class MFAUserTestMixin:
@@ -104,13 +110,17 @@ def test_middleware_allows_setup_paths_and_completed_sessions(self):
 
         with override_config(ENFORCE_MFA_FOR_ADMIN_USERS=True):
             for path in MFA_SETUP_ALLOWED_PATHS | {
-                f"{ALLAUTH_PREFIX}browser/v1/auth/login"
+                f"{ALLAUTH_PREFIX}browser/v1/auth/login",
             }:
                 with self.subTest(path=path):
                     request = self.request_with_session(path)
                     request.user = staff
                     self.assertIsNone(middleware.process_view(request, None, (), {}))
 
+            request = self.request_with_session(MFA_LOGIN_PATH, method="post")
+            request.user = staff
+            self.assertIsNone(middleware.process_view(request, None, (), {}))
+
             request = self.request_with_session("/api/profile/")
             request.user = staff
             request.session[MFA_SESSION_KEY] = str(staff.pk)
@@ -179,6 +189,68 @@ def test_successful_enrollment_marks_the_current_session(self):
         self.assertNotIn(MFA_SESSION_KEY, request.session)
 
 
+class DiscourseSSOMFAEnforcementTests(MFAUserTestMixin, TestCase):
+    def signed_sso_data(self):
+        secret = "sso-secret"
+        payload = base64.b64encode(
+            urlencode(
+                {
+                    "nonce": "nonce-1",
+                    "return_sso_url": "https://discourse.example.test/session",
+                }
+            ).encode()
+        ).decode()
+        signature = hmac.new(
+            secret.encode(), payload.encode(), digestmod=hashlib.sha256
+        ).hexdigest()
+        return {"sso": payload, "sig": signature}, secret
+
+    def test_authenticated_staff_cannot_issue_sso_handoff_without_mfa(self):
+        user = self.make_user("discourse-staff@example.test", staff=True)
+        Profile.objects.create(
+            user=user,
+            first_name="Discourse",
+            last_name="Staff",
+        )
+        sso_data, secret = self.signed_sso_data()
+        client = APIClient()
+        client.force_login(user)
+
+        with override_config(
+            ENABLE_DISCOURSE_SSO_PROTOCOL=True,
+            DISCOURSE_SSO_PROTOCOL_SECRET_KEY=secret,
+            ENFORCE_MFA_FOR_ADMIN_USERS=True,
+        ):
+            response = client.post("/api/login/", {"sso": sso_data}, format="json")
+
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+        self.assertEqual(response.json()["code"], "mfa_required")
+        self.assertNotIn("_auth_user_id", client.session)
+
+    def test_staff_password_sso_login_returns_mfa_code(self):
+        user = self.make_user("discourse-password@example.test", staff=True)
+        sso_data, secret = self.signed_sso_data()
+        client = APIClient()
+
+        with override_config(
+            ENABLE_DISCOURSE_SSO_PROTOCOL=True,
+            DISCOURSE_SSO_PROTOCOL_SECRET_KEY=secret,
+            ENFORCE_MFA_FOR_ADMIN_USERS=True,
+        ):
+            response = client.post(
+                "/api/login/",
+                {
+                    "email": user.email,
+                    "password": "test-password",
+                    "sso": sso_data,
+                },
+                format="json",
+            )
+
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+        self.assertEqual(response.json()["code"], "mfa_required")
+
+
 class LegacyTokenMFAEnforcementTests(MFAUserTestMixin, TestCase):
     def test_staff_obtain_and_refresh_are_blocked_when_mfa_is_enforced(self):
         user = self.make_user("token-staff@example.test", staff=True)
diff --git a/memberportal/api_general/views.py b/memberportal/api_general/views.py
index f415036d..4beb9f6a 100644
--- a/memberportal/api_general/views.py
+++ b/memberportal/api_general/views.py
@@ -207,7 +207,26 @@ def post(self, request):
                 # if sso is disabled then exit
                 return Response(status=status.HTTP_400_BAD_REQUEST)
 
+        from membermatters.mfa_policy import (
+            admin_mfa_required,
+            request_has_verified_mfa,
+        )
+
         if request.user.is_authenticated:
+            if admin_mfa_required(request.user) and not request_has_verified_mfa(
+                request, request.user
+            ):
+                # Discard a password-only session so the frontend can restart
+                # through AllAuth and complete its MFA stage.
+                logout(request)
+                return Response(
+                    {
+                        "code": "mfa_required",
+                        "detail": "Use the AllAuth login endpoint to complete MFA.",
+                    },
+                    status=status.HTTP_403_FORBIDDEN,
+                )
+
             if discourse_login:
                 payload = {
                     "nonce": discourse_nonce,
@@ -238,10 +257,6 @@ def post(self, request):
 
         # correct login details
         if user is not None:
-            # Enforced staff users must use AllAuth so its MFA stage cannot be
-            # bypassed by the legacy custom login endpoint.
-            from membermatters.mfa_policy import admin_mfa_required
-
             if admin_mfa_required(user):
                 return Response(
                     {
diff --git a/memberportal/membermatters/mfa_policy.py b/memberportal/membermatters/mfa_policy.py
index c0664500..066ee5ff 100644
--- a/memberportal/membermatters/mfa_policy.py
+++ b/memberportal/membermatters/mfa_policy.py
@@ -12,10 +12,10 @@
 
 MFA_SESSION_KEY = "membermatters.mfa_verified_user"
 ALLAUTH_PREFIX = "/_allauth/"
+MFA_LOGIN_PATH = "/api/login/"
 MFA_SETUP_ALLOWED_PATHS = {
     "/api/logout/",
     "/api/config/",
-    "/api/login/",
     "/api/token/obtain/",
     "/api/token/refresh/",
 }
@@ -82,6 +82,11 @@ def process_view(self, request, view_func, view_args, view_kwargs):
             # enrollment when a staff member has no authenticator yet.
             return None
 
+        if request.path == MFA_LOGIN_PATH and request.method == "POST":
+            # The login endpoint must be reachable for first-factor requests;
+            # Login.post enforces MFA for any already-authenticated staff user.
+            return None
+
         user = request.user
         if not user.is_authenticated:
             try:
diff --git a/src-frontend/src/components/LoginCard.vue b/src-frontend/src/components/LoginCard.vue
index 4d79e273..2ad60a23 100644
--- a/src-frontend/src/components/LoginCard.vue
+++ b/src-frontend/src/components/LoginCard.vue
@@ -540,7 +540,7 @@ export default defineComponent({
       this.loginError = false;
 
       if (this.discourseSsoData) {
-        this.login();
+        this.completeDiscourseSso();
         return;
       }
 
@@ -577,6 +577,17 @@ export default defineComponent({
         this.login();
       }
     },
+    async completeDiscourseSso() {
+      try {
+        const response = await this.$axios.post('/api/login/', {
+          sso: this.discourseSsoData,
+        });
+        this.loginComplete = true;
+        window.location = response.data.redirect;
+      } catch {
+        this.loginError = true;
+      }
+    },
     /**
      * This sends the login API request to log the user in.
      */
@@ -597,7 +608,13 @@ export default defineComponent({
             window.location = response.data.redirect;
           })
           .catch((error) => {
-            if (error.response?.status === 401) {
+            if (
+              error.response?.status === 403 &&
+              error.response.data?.code === 'mfa_required'
+            ) {
+              this.unverifiedEmail = false;
+              this.loginWithAllauth();
+            } else if (error.response?.status === 401) {
               this.loginFailed = true;
               this.unverifiedEmail = false;
             } else if (error.response?.status === 403) {

From b20cb08494f087ff0335de157a43c1357cf98681 Mon Sep 17 00:00:00 2001
From: Rechner Fox <659028+rechner@users.noreply.github.com>
Date: Sat, 19 Sep 2026 23:02:50 -0700
Subject: [PATCH 4/9] Default to passwordless passkey

---
 src-frontend/src/components/LoginCard.vue | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src-frontend/src/components/LoginCard.vue b/src-frontend/src/components/LoginCard.vue
index 2ad60a23..08315e18 100644
--- a/src-frontend/src/components/LoginCard.vue
+++ b/src-frontend/src/components/LoginCard.vue
@@ -734,6 +734,7 @@ export default defineComponent({
           this.allauthPath('/account/authenticators/webauthn'),
           {
             name: 'MemberMatters passkey',
+            passwordless: true,
             credential: serializeWebAuthnCreationCredential(
               credential as PublicKeyCredential,
             ),

From 91fb0f747e8c70331a8c8e3502fde2a53eaffdc6 Mon Sep 17 00:00:00 2001
From: Rechner Fox <659028+rechner@users.noreply.github.com>
Date: Sat, 19 Sep 2026 23:12:05 -0700
Subject: [PATCH 5/9] Ensure MFA completion markers are properly stored in the
 correct session store for app/web

---
 memberportal/api_general/tests/test_mfa.py | 27 ++++++++--
 memberportal/membermatters/mfa_policy.py   | 61 +++++++++++++++++++---
 2 files changed, 77 insertions(+), 11 deletions(-)

diff --git a/memberportal/api_general/tests/test_mfa.py b/memberportal/api_general/tests/test_mfa.py
index 8a5c23da..eb2477db 100644
--- a/memberportal/api_general/tests/test_mfa.py
+++ b/memberportal/api_general/tests/test_mfa.py
@@ -8,6 +8,7 @@
 from django.http import HttpResponse
 from django.test import RequestFactory, TestCase
 from django.urls import resolve
+from django.utils.module_loading import import_string
 from django.contrib.sessions.middleware import SessionMiddleware
 from rest_framework import status
 from rest_framework.test import APIClient
@@ -72,8 +73,8 @@ def test_headless_mfa_and_passkey_routes_are_available(self):
 
 
 class MFAAuthenticationPolicyTests(MFAUserTestMixin, TestCase):
-    def request_with_session(self, path, method="get"):
-        request = getattr(RequestFactory(), method)(path)
+    def request_with_session(self, path, method="get", **kwargs):
+        request = getattr(RequestFactory(), method)(path, **kwargs)
         SessionMiddleware(lambda _: HttpResponse()).process_request(request)
         request.session.save()
         return request
@@ -167,7 +168,27 @@ def test_token_session_marker_is_accepted(self):
         request.auth = {"sid": token_session.session_key}
         self.assertTrue(request_has_verified_mfa(request, user))
 
-    def test_successful_enrollment_marks_the_current_session(self):
+    def test_app_enrollment_marks_the_token_backed_session(self):
+        user = self.make_user("mfa-app-enrollment@example.test")
+        token_request = self.request_with_session("/api/profile/")
+        token_session = token_request.session
+        token_session["_auth_user_id"] = str(user.pk)
+        token_session.save()
+
+        request = self.request_with_session(
+            "/_allauth/app/v1/account/authenticators/totp",
+            method="post",
+            HTTP_X_SESSION_TOKEN=token_session.session_key,
+        )
+        middleware = AdminMFAMiddleware(lambda _: HttpResponse())
+        middleware.process_view(request, None, (), {})
+        middleware.process_response(request, HttpResponse(status=200))
+
+        session_store = import_string(settings.SESSION_ENGINE + ".SessionStore")
+        saved_session = session_store(session_key=token_session.session_key)
+        self.assertEqual(saved_session[MFA_SESSION_KEY], str(user.pk))
+        self.assertNotIn(MFA_SESSION_KEY, request.session)
+
         user = self.make_user("mfa-enrollment@example.test")
         middleware = AdminMFAMiddleware(lambda _: HttpResponse())
 
diff --git a/memberportal/membermatters/mfa_policy.py b/memberportal/membermatters/mfa_policy.py
index 066ee5ff..4ae72838 100644
--- a/memberportal/membermatters/mfa_policy.py
+++ b/memberportal/membermatters/mfa_policy.py
@@ -1,11 +1,14 @@
 from __future__ import annotations
 
 from django.conf import settings
+from django.contrib.auth import get_user_model
 from django.contrib.auth.signals import user_logged_out
 from django.http import HttpRequest, JsonResponse
 from django.utils.deprecation import MiddlewareMixin
-from django.dispatch import receiver
 from django.utils.module_loading import import_string
+from django.dispatch import receiver
+
+from rest_framework.exceptions import AuthenticationFailed
 
 from allauth.mfa.signals import authenticator_used
 from constance import config
@@ -29,6 +32,37 @@ def admin_mfa_required(user) -> bool:
     )
 
 
+def _capture_allauth_app_session(request: HttpRequest) -> None:
+    session_key = request.headers.get("X-Session-Token")
+    user = None
+
+    if not session_key:
+        try:
+            from allauth.headless.contrib.rest_framework.authentication import (
+                JWTTokenAuthentication,
+            )
+
+            authentication = JWTTokenAuthentication().authenticate(request)
+            if authentication:
+                user, token = authentication
+                if isinstance(token, dict):
+                    session_key = token.get("sid")
+        except AuthenticationFailed:
+            return
+
+    if not session_key:
+        return
+
+    setattr(request, "_membermatters_mfa_session_key", session_key)
+    session_store = import_string(settings.SESSION_ENGINE + ".SessionStore")
+    token_session = session_store(session_key=session_key)
+    if user is None:
+        user_id = token_session.get("_auth_user_id")
+        if user_id is not None:
+            user = get_user_model().objects.filter(pk=user_id).first()
+    setattr(request, "_membermatters_mfa_user", user)
+
+
 def _session_has_mfa_marker(session, user) -> bool:
     return str(session.get(MFA_SESSION_KEY, "")) == str(user.pk)
 
@@ -78,8 +112,9 @@ def process_view(self, request, view_func, view_args, view_kwargs):
             return None
 
         if request.path.startswith(ALLAUTH_PREFIX):
-            # AllAuth needs these endpoints to remain available for first-time
-            # enrollment when a staff member has no authenticator yet.
+            # Capture the app session before AllAuth temporarily swaps and
+            # restores request.session inside its headless decorator.
+            _capture_allauth_app_session(request)
             return None
 
         if request.path == MFA_LOGIN_PATH and request.method == "POST":
@@ -125,10 +160,20 @@ def process_response(self, request, response):
                 or request.path.endswith("/account/authenticators/webauthn")
             )
             and response.status_code < 300
-            and getattr(request.user, "is_authenticated", False)
         ):
-            # Enrollment verifies the TOTP code or WebAuthn assertion. Treat
-            # that successful ceremony as MFA completion for this session.
-            request.session[MFA_SESSION_KEY] = str(request.user.pk)
-            request.session.modified = True
+            # Enrollment verifies the TOTP code or WebAuthn assertion. For app
+            # clients, write to the token-backed session captured in
+            # process_view; AllAuth has restored the original request session
+            # by the time this response hook runs.
+            user = getattr(request, "_membermatters_mfa_user", None)
+            session_key = getattr(request, "_membermatters_mfa_session_key", None)
+            if session_key:
+                session_store = import_string(settings.SESSION_ENGINE + ".SessionStore")
+                session = session_store(session_key=session_key)
+                if user is not None:
+                    session[MFA_SESSION_KEY] = str(user.pk)
+                    session.save()
+            elif getattr(request.user, "is_authenticated", False):
+                request.session[MFA_SESSION_KEY] = str(request.user.pk)
+                request.session.modified = True
         return response

From 74ed04308c5ce838013e54adc092842e38c748a0 Mon Sep 17 00:00:00 2001
From: Rechner Fox <659028+rechner@users.noreply.github.com>
Date: Sat, 19 Sep 2026 23:33:37 -0700
Subject: [PATCH 6/9] Create method-gated allowlist for /_allauth middleware
 exceptions

---
 memberportal/api_general/tests/test_mfa.py | 24 ++++++++-
 memberportal/membermatters/mfa_policy.py   | 60 ++++++++++++++++++----
 2 files changed, 72 insertions(+), 12 deletions(-)

diff --git a/memberportal/api_general/tests/test_mfa.py b/memberportal/api_general/tests/test_mfa.py
index eb2477db..222f058c 100644
--- a/memberportal/api_general/tests/test_mfa.py
+++ b/memberportal/api_general/tests/test_mfa.py
@@ -1,10 +1,12 @@
 import base64
 import hashlib
 import hmac
+import json
 from urllib.parse import urlencode
 
 from django.conf import settings
 from django.contrib.auth import user_logged_out
+from django.contrib.auth.models import AnonymousUser
 from django.http import HttpResponse
 from django.test import RequestFactory, TestCase
 from django.urls import resolve
@@ -140,7 +142,26 @@ def test_middleware_does_not_block_non_staff_or_options(self):
             request.user = member
             self.assertIsNone(middleware.process_view(request, None, (), {}))
 
-    def test_mfa_signal_marks_and_logout_clears_session(self):
+    def test_unverified_staff_cannot_use_allauth_account_mutations(self):
+        staff = self.make_user("middleware-account-mutation@example.test", staff=True)
+        middleware = AdminMFAMiddleware(lambda _: HttpResponse())
+        blocked_requests = (
+            ("post", "/_allauth/browser/v1/account/password/change"),
+            ("delete", "/_allauth/browser/v1/account/authenticators/webauthn"),
+            ("post", "/_allauth/browser/v1/account/authenticators/recovery-codes"),
+        )
+
+        with override_config(ENFORCE_MFA_FOR_ADMIN_USERS=True):
+            for method, path in blocked_requests:
+                with self.subTest(method=method, path=path):
+                    request = self.request_with_session(path, method=method)
+                    request.user = staff
+                    response = middleware.process_view(request, None, (), {})
+                    self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+                    self.assertEqual(
+                        json.loads(response.content)["code"], "mfa_required"
+                    )
+
         user = self.make_user("mfa-signals@example.test")
         request = self.request_with_session("/api/profile/")
 
@@ -180,6 +201,7 @@ def test_app_enrollment_marks_the_token_backed_session(self):
             method="post",
             HTTP_X_SESSION_TOKEN=token_session.session_key,
         )
+        request.user = AnonymousUser()
         middleware = AdminMFAMiddleware(lambda _: HttpResponse())
         middleware.process_view(request, None, (), {})
         middleware.process_response(request, HttpResponse(status=200))
diff --git a/memberportal/membermatters/mfa_policy.py b/memberportal/membermatters/mfa_policy.py
index 4ae72838..783d27da 100644
--- a/memberportal/membermatters/mfa_policy.py
+++ b/memberportal/membermatters/mfa_policy.py
@@ -54,6 +54,8 @@ def _capture_allauth_app_session(request: HttpRequest) -> None:
         return
 
     setattr(request, "_membermatters_mfa_session_key", session_key)
+    if not getattr(request, "auth", None):
+        request.auth = {"sid": session_key}
     session_store = import_string(settings.SESSION_ENGINE + ".SessionStore")
     token_session = session_store(session_key=session_key)
     if user is None:
@@ -63,6 +65,32 @@ def _capture_allauth_app_session(request: HttpRequest) -> None:
     setattr(request, "_membermatters_mfa_user", user)
 
 
+def _allauth_path_allowed_for_unverified_staff(path: str, method: str) -> bool:
+    normalized_path = path.rstrip("/")
+    suffix = "/" + normalized_path.split("/v1/", 1)[-1].lstrip("/")
+
+    match suffix:
+        case (
+            "/auth/login"
+            | "/auth/2fa/authenticate"
+            | "/auth/webauthn/login"
+            | "/auth/webauthn/authenticate"
+        ):
+            return True
+        case "/config" if method == "GET":
+            return True
+        case "/auth/session" if method == "DELETE":
+            return True
+        case "/account/authenticators" if method == "GET":
+            return True
+        case (
+            "/account/authenticators/totp" | "/account/authenticators/webauthn"
+        ) if method in {"GET", "POST"}:
+            return True
+        case _:
+            return False
+
+
 def _session_has_mfa_marker(session, user) -> bool:
     return str(session.get(MFA_SESSION_KEY, "")) == str(user.pk)
 
@@ -111,11 +139,11 @@ def process_view(self, request, view_func, view_args, view_kwargs):
         if request.method == "OPTIONS":
             return None
 
-        if request.path.startswith(ALLAUTH_PREFIX):
+        is_allauth_path = request.path.startswith(ALLAUTH_PREFIX)
+        if is_allauth_path:
             # Capture the app session before AllAuth temporarily swaps and
             # restores request.session inside its headless decorator.
             _capture_allauth_app_session(request)
-            return None
 
         if request.path == MFA_LOGIN_PATH and request.method == "POST":
             # The login endpoint must be reachable for first-factor requests;
@@ -124,15 +152,20 @@ def process_view(self, request, view_func, view_args, view_kwargs):
 
         user = request.user
         if not user.is_authenticated:
-            try:
-                from membermatters.authentication import HybridJWTAuthentication
-
-                authentication = HybridJWTAuthentication().authenticate(request)
-                if authentication:
-                    user, request.auth = authentication
-                    request.user = user
-            except Exception:
-                user = request.user
+            captured_user = getattr(request, "_membermatters_mfa_user", None)
+            if captured_user is not None:
+                user = captured_user
+                request.user = user
+            else:
+                try:
+                    from membermatters.authentication import HybridJWTAuthentication
+
+                    authentication = HybridJWTAuthentication().authenticate(request)
+                    if authentication:
+                        user, request.auth = authentication
+                        request.user = user
+                except Exception:
+                    user = request.user
 
         if not admin_mfa_required(user):
             return None
@@ -143,6 +176,11 @@ def process_view(self, request, view_func, view_args, view_kwargs):
         if request_has_verified_mfa(request, user):
             return None
 
+        if is_allauth_path and _allauth_path_allowed_for_unverified_staff(
+            request.path, request.method
+        ):
+            return None
+
         return JsonResponse(
             {
                 "code": "mfa_required",

From f044c49daab50a70c886a2fecbb228137cf405b0 Mon Sep 17 00:00:00 2001
From: Rechner Fox <659028+rechner@users.noreply.github.com>
Date: Sun, 20 Sep 2026 15:15:27 -0700
Subject: [PATCH 7/9] tests(auth): Additoinal test coverage

- Fix `_session_for_token()` to support both raw session token and encrypted AllAuth JWT claim
---
 memberportal/api_general/tests/test_mfa.py | 138 ++++++++++++++++++++-
 memberportal/membermatters/mfa_policy.py   |   9 +-
 2 files changed, 144 insertions(+), 3 deletions(-)

diff --git a/memberportal/api_general/tests/test_mfa.py b/memberportal/api_general/tests/test_mfa.py
index 222f058c..98851d11 100644
--- a/memberportal/api_general/tests/test_mfa.py
+++ b/memberportal/api_general/tests/test_mfa.py
@@ -2,13 +2,14 @@
 import hashlib
 import hmac
 import json
+import time
 from urllib.parse import urlencode
 
 from django.conf import settings
 from django.contrib.auth import user_logged_out
 from django.contrib.auth.models import AnonymousUser
 from django.http import HttpResponse
-from django.test import RequestFactory, TestCase
+from django.test import RequestFactory, TestCase, override_settings
 from django.urls import resolve
 from django.utils.module_loading import import_string
 from django.contrib.sessions.middleware import SessionMiddleware
@@ -16,8 +17,17 @@
 from rest_framework.test import APIClient
 from rest_framework_simplejwt.tokens import RefreshToken
 
+from allauth.mfa import app_settings as mfa_settings
 from allauth.mfa.models import Authenticator
 from allauth.mfa.signals import authenticator_used
+from allauth.mfa.totp.internal.auth import (
+    TOTP,
+    format_hotp_value,
+    generate_totp_secret,
+    hotp_value,
+    validate_totp_code,
+)
+from allauth.mfa.webauthn.forms import AddWebAuthnForm
 from constance.test.unittest import override_config
 
 from membermatters.mfa_policy import (
@@ -40,8 +50,27 @@ def make_user(self, email, staff=False):
             user.save(update_fields=["staff"])
         return user
 
+    def make_profile(self, email, staff=False):
+        user = self.make_user(email, staff=staff)
+        Profile.objects.create(
+            user=user,
+            first_name="MFA",
+            last_name="Test",
+            screen_name=f"mfa-{user.pk}",
+        )
+        return user
+
+    def add_totp(self, user):
+        secret = generate_totp_secret()
+        TOTP.activate(user, secret)
+        return secret
 
-class AllAuthConfigurationTests(TestCase):
+    def totp_code(self, secret):
+        counter = int(time.time()) // mfa_settings.TOTP_PERIOD
+        return format_hotp_value(hotp_value(secret, counter))
+
+
+class AllAuthConfigurationTests(MFAUserTestMixin, TestCase):
     def test_headless_mfa_and_passkey_routes_are_available(self):
         self.assertTrue(settings.HEADLESS_ONLY)
         self.assertEqual(settings.HEADLESS_CLIENTS, ("browser", "app"))
@@ -73,6 +102,91 @@ def test_headless_mfa_and_passkey_routes_are_available(self):
             with self.subTest(path=path):
                 self.assertEqual(resolve(path).url_name, url_name)
 
+    def test_browser_login_returns_authenticated_headless_response(self):
+        user = self.make_profile("allauth-browser@example.test")
+        client = APIClient()
+
+        response = client.post(
+            "/_allauth/browser/v1/auth/login",
+            {"email": user.email, "password": "test-password"},
+            format="json",
+        )
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        body = response.json()
+        self.assertEqual(body["status"], status.HTTP_200_OK)
+        self.assertTrue(body["meta"]["is_authenticated"])
+        self.assertEqual(body["data"]["user"]["id"], user.pk)
+
+    @override_settings(MFA_TOTP_TOLERANCE=1)
+    def test_browser_login_stages_and_completes_totp(self):
+        user = self.make_profile("allauth-browser-mfa@example.test")
+        secret = self.add_totp(user)
+        client = APIClient()
+
+        pending = client.post(
+            "/_allauth/browser/v1/auth/login",
+            {"email": user.email, "password": "test-password"},
+            format="json",
+        )
+        self.assertEqual(pending.status_code, status.HTTP_401_UNAUTHORIZED)
+        flow = next(
+            flow
+            for flow in pending.json()["data"]["flows"]
+            if flow["id"] == "mfa_authenticate"
+        )
+        self.assertTrue(flow["is_pending"])
+        self.assertIn("totp", flow["types"])
+        code = self.totp_code(secret)
+        self.assertTrue(validate_totp_code(secret, code))
+
+        completed = client.post(
+            "/_allauth/browser/v1/auth/2fa/authenticate",
+            {"code": code},
+            format="json",
+        )
+        self.assertEqual(completed.status_code, status.HTTP_200_OK, completed.json())
+        self.assertTrue(completed.json()["meta"]["is_authenticated"])
+
+    def test_app_login_mfa_token_authenticates_protected_api(self):
+        user = self.make_profile("allauth-app-mfa@example.test", staff=True)
+        secret = self.add_totp(user)
+        client = APIClient()
+
+        with override_config(ENFORCE_MFA_FOR_ADMIN_USERS=True), override_settings(
+            HEADLESS_JWT_ALGORITHM="HS256",
+            MFA_TOTP_TOLERANCE=1,
+        ):
+            pending = client.post(
+                "/_allauth/app/v1/auth/login",
+                {"email": user.email, "password": "test-password"},
+                format="json",
+            )
+            self.assertEqual(pending.status_code, status.HTTP_401_UNAUTHORIZED)
+            session_token = pending.json()["meta"]["session_token"]
+            code = self.totp_code(secret)
+
+            completed = client.post(
+                "/_allauth/app/v1/auth/2fa/authenticate",
+                {"code": code},
+                format="json",
+                HTTP_X_SESSION_TOKEN=session_token,
+            )
+            self.assertEqual(completed.status_code, status.HTTP_200_OK)
+            access_token = completed.json()["meta"]["access_token"]
+
+            profile = client.get(
+                "/api/profile/",
+                HTTP_AUTHORIZATION=f"Bearer {access_token}",
+            )
+
+        self.assertEqual(profile.status_code, status.HTTP_200_OK)
+        self.assertEqual(profile.json()["id"], user.pk)
+
+    def test_passwordless_webauthn_contract_is_enabled(self):
+        self.assertIn("passwordless", AddWebAuthnForm.base_fields)
+        self.assertTrue(settings.MFA_PASSKEY_LOGIN_ENABLED)
+
 
 class MFAAuthenticationPolicyTests(MFAUserTestMixin, TestCase):
     def request_with_session(self, path, method="get", **kwargs):
@@ -293,6 +407,26 @@ def test_staff_password_sso_login_returns_mfa_code(self):
         self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
         self.assertEqual(response.json()["code"], "mfa_required")
 
+    def test_staff_with_mfa_marker_can_issue_sso_handoff(self):
+        user = self.make_profile("discourse-positive@example.test", staff=True)
+        sso_data, secret = self.signed_sso_data()
+        client = APIClient()
+        client.force_login(user)
+        session = client.session
+        session[MFA_SESSION_KEY] = str(user.pk)
+        session.save()
+
+        with override_config(
+            ENABLE_DISCOURSE_SSO_PROTOCOL=True,
+            DISCOURSE_SSO_PROTOCOL_SECRET_KEY=secret,
+            ENFORCE_MFA_FOR_ADMIN_USERS=True,
+        ):
+            response = client.post("/api/login/", {"sso": sso_data}, format="json")
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertIn("sso=", response.json()["redirect"])
+        self.assertIn("sig=", response.json()["redirect"])
+
 
 class LegacyTokenMFAEnforcementTests(MFAUserTestMixin, TestCase):
     def test_staff_obtain_and_refresh_are_blocked_when_mfa_is_enforced(self):
diff --git a/memberportal/membermatters/mfa_policy.py b/memberportal/membermatters/mfa_policy.py
index 783d27da..164c906d 100644
--- a/memberportal/membermatters/mfa_policy.py
+++ b/memberportal/membermatters/mfa_policy.py
@@ -10,6 +10,7 @@
 
 from rest_framework.exceptions import AuthenticationFailed
 
+from allauth.headless.tokens.strategies.jwt.internal import session_key_from_sid
 from allauth.mfa.signals import authenticator_used
 from constance import config
 
@@ -107,7 +108,13 @@ def _session_for_token(request: HttpRequest):
         if not session_id:
             continue
         session_store = import_string(settings.SESSION_ENGINE + ".SessionStore")
-        return session_store(session_key=session_id)
+        raw_session = session_store(session_key=session_id)
+        if raw_session.exists(session_id):
+            return raw_session
+
+        decoded_session_id = session_key_from_sid(session_id)
+        if decoded_session_id:
+            return session_store(session_key=decoded_session_id)
     return None
 
 

From 5655eda07c94828acfa474670eb89f9c32f3ca64 Mon Sep 17 00:00:00 2001
From: Rechner Fox <659028+rechner@users.noreply.github.com>
Date: Sun, 20 Sep 2026 15:40:09 -0700
Subject: [PATCH 8/9] bugfix(auth): Allow existing model sessions

---
 memberportal/api_general/tests/test_mfa.py | 21 +++++++++++++++++++--
 memberportal/membermatters/settings.py     |  6 +++++-
 2 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/memberportal/api_general/tests/test_mfa.py b/memberportal/api_general/tests/test_mfa.py
index 98851d11..7878dac3 100644
--- a/memberportal/api_general/tests/test_mfa.py
+++ b/memberportal/api_general/tests/test_mfa.py
@@ -118,8 +118,25 @@ def test_browser_login_returns_authenticated_headless_response(self):
         self.assertTrue(body["meta"]["is_authenticated"])
         self.assertEqual(body["data"]["user"]["id"], user.pk)
 
-    @override_settings(MFA_TOTP_TOLERANCE=1)
-    def test_browser_login_stages_and_completes_totp(self):
+    def test_legacy_model_backend_sessions_remain_authenticated(self):
+        user = self.make_profile("legacy-session@example.test")
+        client = APIClient()
+        client.force_login(user, backend="django.contrib.auth.backends.ModelBackend")
+
+        response = client.get("/api/loggedin/")
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+
+    def test_legacy_staff_session_still_requires_mfa_when_enforced(self):
+        user = self.make_profile("legacy-staff-session@example.test", staff=True)
+        client = APIClient()
+        client.force_login(user, backend="django.contrib.auth.backends.ModelBackend")
+
+        with override_config(ENFORCE_MFA_FOR_ADMIN_USERS=True):
+            response = client.get("/api/profile/")
+
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+        self.assertEqual(response.json()["code"], "mfa_required")
         user = self.make_profile("allauth-browser-mfa@example.test")
         secret = self.add_totp(user)
         client = APIClient()
diff --git a/memberportal/membermatters/settings.py b/memberportal/membermatters/settings.py
index c079a647..01bb2576 100644
--- a/memberportal/membermatters/settings.py
+++ b/memberportal/membermatters/settings.py
@@ -445,7 +445,11 @@
 
 # Django-AllAuth is used in headless mode by the Vue SPA. Existing custom
 # registration and password-reset APIs remain the source of truth.
-AUTHENTICATION_BACKENDS = ("allauth.account.auth_backends.AuthenticationBackend",)
+AUTHENTICATION_BACKENDS = (
+    "allauth.account.auth_backends.AuthenticationBackend",
+    # Keep loading sessions created before AllAuth
+    "django.contrib.auth.backends.ModelBackend",
+)
 ACCOUNT_ADAPTER = "membermatters.adapters.MemberMattersAccountAdapter"
 ACCOUNT_USER_MODEL_USERNAME_FIELD = None
 ACCOUNT_USER_MODEL_EMAIL_FIELD = "email"

From a4a7273ca37ae2a976da7b7429c1a9ef7904129e Mon Sep 17 00:00:00 2001
From: Rechner Fox <659028+rechner@users.noreply.github.com>
Date: Sun, 20 Sep 2026 18:54:39 -0700
Subject: [PATCH 9/9] feat(auth): custom named passkey field, MFA configuration
 dialog

- Add SE translation (machine translation)
---
 .../membermatters/constance_config.py         |   3 +-
 src-frontend/src/App.vue                      |   6 +
 src-frontend/src/boot/axios.ts                |   7 +-
 src-frontend/src/components/LoginCard.vue     |  22 +-
 .../src/components/MfaSettingsCard.vue        | 521 ++++++++++++++++++
 src-frontend/src/i18n/en-AU/index.ts          |  32 ++
 src-frontend/src/i18n/sv-SE/index.ts          |  32 ++
 src-frontend/src/pages/Profile.vue            |  20 +-
 8 files changed, 636 insertions(+), 7 deletions(-)
 create mode 100644 src-frontend/src/components/MfaSettingsCard.vue

diff --git a/memberportal/membermatters/constance_config.py b/memberportal/membermatters/constance_config.py
index b2dc37b1..be0edcf5 100644
--- a/memberportal/membermatters/constance_config.py
+++ b/memberportal/membermatters/constance_config.py
@@ -22,7 +22,8 @@
     ),
     "ENFORCE_MFA_FOR_ADMIN_USERS": (
         False,
-        "Require completed MFA for all staff users before allowing portal or Django admin access.",
+        "Require completed MFA for all staff users before allowing portal or Django admin access.  "
+        "IMPORTANT: Make sure MFA is configured for your user before enabling this or you will be locked out!",
     ),
     # Email config
     "EMAIL_SYSADMIN": (
diff --git a/src-frontend/src/App.vue b/src-frontend/src/App.vue
index 6a4bd876..cc9477cc 100644
--- a/src-frontend/src/App.vue
+++ b/src-frontend/src/App.vue
@@ -57,6 +57,12 @@ export default defineComponent({
     this.$axios.interceptors.response.use(
       (response) => response,
       (error) => {
+        const isAllauthRequest =
+          error.response?.config?.url?.includes('/_allauth/');
+        if (isAllauthRequest) {
+          return Promise.reject(error);
+        }
+
         // If we get a 401 and it's not the loggedin check endpoint, or reset password/login page, redirect user to login screen
         if (
           error.response &&
diff --git a/src-frontend/src/boot/axios.ts b/src-frontend/src/boot/axios.ts
index 99893cb9..f0db0058 100644
--- a/src-frontend/src/boot/axios.ts
+++ b/src-frontend/src/boot/axios.ts
@@ -34,7 +34,12 @@ export default boot(({ app }) => {
       return response;
     },
     function (error) {
-      if (error.response && error.response.status === 401) {
+      const isAllauthRequest = error.config?.url?.includes('/_allauth/');
+      if (
+        error.response &&
+        error.response.status === 401 &&
+        !isAllauthRequest
+      ) {
         store.commit('auth/setAuth', {});
         return Promise.reject(error);
       } else {
diff --git a/src-frontend/src/components/LoginCard.vue b/src-frontend/src/components/LoginCard.vue
index 08315e18..14a4d0b0 100644
--- a/src-frontend/src/components/LoginCard.vue
+++ b/src-frontend/src/components/LoginCard.vue
@@ -167,6 +167,12 @@
           <q-banner v-if="loginError" class="bg-negative text-white q-mt-md">
             {{ $t('error.requestFailed') }}
           </q-banner>
+          <q-input
+            v-model="passkeyName"
+            filled
+            :label="$t('mfaSettings.passkeyName')"
+            :hint="$t('mfaSettings.passkeyNameHint')"
+          />
           <div class="row q-mt-md">
             <q-space />
             <q-btn
@@ -180,6 +186,7 @@
               flat
               color="primary"
               :loading="buttonLoading"
+              :disable="!passkeyName.trim()"
               @click="addPasskey"
             />
             <q-btn
@@ -360,9 +367,12 @@ type WebAuthnRequestOptionsJSON = {
 };
 
 function parseWebAuthnRequestOptions(
-  options: WebAuthnRequestOptionsJSON,
+  options: WebAuthnRequestOptionsJSON & {
+    publicKey?: WebAuthnRequestOptionsJSON;
+  },
 ): PublicKeyCredentialRequestOptions {
-  const parsed = { ...options };
+  const publicKey = options.publicKey || options;
+  const parsed = { ...publicKey };
   parsed.challenge = decodeBase64Url(parsed.challenge);
   const credentials = parsed.allowCredentials || parsed.allow_credentials;
   if (credentials) {
@@ -399,12 +409,14 @@ function serializeWebAuthnCredential(
 
 function parseWebAuthnCreationOptions(
   options: WebAuthnRequestOptionsJSON & {
+    publicKey?: WebAuthnRequestOptionsJSON;
     user: { id: string; [key: string]: unknown };
     excludeCredentials?: WebAuthnCredentialDescriptorJSON[];
     exclude_credentials?: WebAuthnCredentialDescriptorJSON[];
   },
 ): PublicKeyCredentialCreationOptions {
-  const parsed = { ...options };
+  const publicKey = options.publicKey || options;
+  const parsed = { ...publicKey };
   parsed.challenge = decodeBase64Url(parsed.challenge);
   parsed.user = {
     ...parsed.user,
@@ -464,6 +476,7 @@ export default defineComponent({
       mfaTypes: [] as string[],
       mfaSetupRequired: false,
       mfaSetupCode: '',
+      passkeyName: '',
       totpSecret: '',
       totpQrCode: '',
       allauthSessionToken: '',
@@ -733,7 +746,7 @@ export default defineComponent({
         await this.$axios.post(
           this.allauthPath('/account/authenticators/webauthn'),
           {
-            name: 'MemberMatters passkey',
+            name: this.passkeyName.trim(),
             passwordless: true,
             credential: serializeWebAuthnCreationCredential(
               credential as PublicKeyCredential,
@@ -741,6 +754,7 @@ export default defineComponent({
           },
           { headers: this.allauthHeaders() },
         );
+        this.passkeyName = '';
         this.mfaSetupRequired = false;
         this.finishAllauthLogin();
       } catch {
diff --git a/src-frontend/src/components/MfaSettingsCard.vue b/src-frontend/src/components/MfaSettingsCard.vue
new file mode 100644
index 00000000..89f53885
--- /dev/null
+++ b/src-frontend/src/components/MfaSettingsCard.vue
@@ -0,0 +1,521 @@
+<template>
+  <q-card class="mfa-settings-card">
+    <q-card-section>
+      <div class="text-h6">{{ $t('mfaSettings.title') }}</div>
+      <p class="text-body2">{{ $t('mfaSettings.description') }}</p>
+
+      <q-spinner v-if="loading" color="primary" size="2em" />
+
+      <template v-else>
+        <q-banner v-if="error" class="bg-negative text-white q-mb-md">
+          {{ $t('mfaSettings.failed') }}
+        </q-banner>
+        <q-banner v-if="success" class="bg-positive text-white q-mb-md">
+          {{ success }}
+        </q-banner>
+
+        <q-list v-if="authenticators.length" bordered separator class="q-mb-md">
+          <q-item
+            v-for="authenticator in authenticators"
+            :key="authenticatorKey(authenticator)"
+          >
+            <q-item-section>
+              <q-item-label>{{
+                authenticatorLabel(authenticator)
+              }}</q-item-label>
+              <q-item-label caption>
+                {{ authenticatorTypeLabel(authenticator.type) }}
+              </q-item-label>
+            </q-item-section>
+            <q-item-section side>
+              <q-btn
+                v-if="authenticator.type === 'totp'"
+                flat
+                color="negative"
+                :label="$t('mfaSettings.disableTotp')"
+                :loading="actionLoading"
+                @click="disableTotp"
+              />
+              <q-btn
+                v-if="authenticator.type === 'webauthn'"
+                flat
+                color="negative"
+                :label="$t('mfaSettings.removePasskey')"
+                :loading="actionLoading"
+                @click="removePasskey(authenticator.id)"
+              />
+            </q-item-section>
+          </q-item>
+        </q-list>
+
+        <p v-else class="text-body2">{{ $t('mfaSettings.noMethods') }}</p>
+
+        <div v-if="totpSetup" class="q-mb-md">
+          <p class="text-body2">{{ $t('mfaSettings.setupDescription') }}</p>
+          <q-img
+            v-if="totpSetup.qrCode"
+            :src="totpSetup.qrCode"
+            fit="contain"
+            style="max-width: 220px"
+            class="q-mb-md"
+          />
+          <p class="text-caption">
+            {{ $t('mfaSettings.setupKey') }}:
+            <code>{{ totpSetup.secret }}</code>
+          </p>
+          <q-input
+            v-model="totpSetup.code"
+            filled
+            autocomplete="one-time-code"
+            inputmode="numeric"
+            :label="$t('mfaSettings.verificationCode')"
+          />
+          <div class="row q-mt-sm">
+            <q-space />
+            <q-btn
+              flat
+              color="primary"
+              :label="$t('button.cancel')"
+              @click="cancelTotpSetup"
+            />
+            <q-btn
+              color="primary-btn"
+              :label="$t('mfaSettings.enableTotp')"
+              :loading="actionLoading"
+              @click="activateTotp"
+            />
+          </div>
+        </div>
+
+        <div v-if="recoveryCodes.length" class="q-mb-md">
+          <p class="text-body2">
+            {{ $t('mfaSettings.recoveryCodesDescription') }}
+          </p>
+          <code class="mfa-recovery-codes">{{ recoveryCodes.join('\n') }}</code>
+        </div>
+
+        <div class="row q-gutter-sm">
+          <q-input
+            v-model="passkeyName"
+            class="col-12"
+            filled
+            :label="$t('mfaSettings.passkeyName')"
+            :hint="$t('mfaSettings.passkeyNameHint')"
+          />
+          <q-btn
+            outline
+            color="primary"
+            :label="$t('mfaSettings.addPasskey')"
+            :loading="actionLoading"
+            :disable="!passkeyName.trim()"
+            @click="addPasskey"
+          />
+          <q-btn
+            v-if="!hasTotp && !totpSetup"
+            outline
+            color="primary"
+            :label="$t('mfaSettings.enableTotp')"
+            :loading="actionLoading"
+            @click="beginTotpSetup"
+          />
+          <q-btn
+            outline
+            color="primary"
+            :label="$t('mfaSettings.generateRecoveryCodes')"
+            :loading="actionLoading"
+            @click="generateRecoveryCodes"
+          />
+        </div>
+      </template>
+    </q-card-section>
+  </q-card>
+
+  <q-dialog v-model="reauthenticatePrompt" persistent>
+    <q-card style="max-width: 360px">
+      <q-card-section>
+        <div class="text-h6">{{ $t('mfaSettings.reauthenticateTitle') }}</div>
+        <p class="text-body2">
+          {{ $t('mfaSettings.reauthenticateDescription') }}
+        </p>
+        <q-input
+          v-model="reauthenticatePassword"
+          autofocus
+          filled
+          type="password"
+          autocomplete="current-password"
+          :label="$t('mfaSettings.reauthenticatePassword')"
+          @keyup.enter="submitReauthenticate"
+        />
+        <q-banner
+          v-if="reauthenticateError"
+          class="bg-negative text-white q-mt-md"
+        >
+          {{ $t('mfaSettings.reauthenticateFailed') }}
+        </q-banner>
+      </q-card-section>
+      <q-card-actions align="right">
+        <q-btn
+          flat
+          color="primary"
+          :label="$t('button.cancel')"
+          @click="cancelReauthenticate"
+        />
+        <q-btn
+          color="primary-btn"
+          :label="$t('mfaSettings.reauthenticate')"
+          :loading="reauthenticating"
+          @click="submitReauthenticate"
+        />
+      </q-card-actions>
+    </q-card>
+  </q-dialog>
+</template>
+
+<script lang="ts">
+import { Platform, QDialogOptions, Dialog } from 'quasar';
+import { defineComponent } from 'vue';
+import QRCode from 'qrcode';
+
+type Authenticator = {
+  type: string;
+  id?: number;
+  name?: string;
+  created_at?: number;
+  unused_code_count?: number;
+};
+
+type WebAuthnCredentialDescriptorJSON = {
+  id: string;
+  transports?: string[];
+};
+
+type WebAuthnOptionsJSON = {
+  challenge: string;
+  user?: { id: string; [key: string]: unknown };
+  allowCredentials?: WebAuthnCredentialDescriptorJSON[];
+  allow_credentials?: WebAuthnCredentialDescriptorJSON[];
+  excludeCredentials?: WebAuthnCredentialDescriptorJSON[];
+  exclude_credentials?: WebAuthnCredentialDescriptorJSON[];
+  [key: string]: unknown;
+};
+
+function decodeBase64Url(value: string): ArrayBuffer {
+  const normalized = value.replace(/-/g, '+').replace(/_/g, '/');
+  const padded = normalized + '='.repeat((4 - (normalized.length % 4)) % 4);
+  return Uint8Array.from(atob(padded), (char) => char.charCodeAt(0)).buffer;
+}
+
+function encodeBase64Url(value: ArrayBuffer | null): string | null {
+  if (!value) return null;
+  const bytes = new Uint8Array(value);
+  let binary = '';
+  bytes.forEach((byte) => {
+    binary += String.fromCharCode(byte);
+  });
+  return btoa(binary)
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+}
+
+function parseCreationOptions(
+  options: WebAuthnOptionsJSON & { publicKey?: WebAuthnOptionsJSON },
+): PublicKeyCredentialCreationOptions {
+  const publicKey = options.publicKey || options;
+  const parsed = { ...publicKey };
+  parsed.challenge = decodeBase64Url(parsed.challenge);
+  if (parsed.user) {
+    parsed.user = {
+      ...parsed.user,
+      id: decodeBase64Url(parsed.user.id),
+    } as unknown as { id: string; [key: string]: unknown };
+  }
+  const credentials = parsed.excludeCredentials || parsed.exclude_credentials;
+  if (credentials) {
+    parsed.excludeCredentials = credentials.map((credential) => ({
+      ...credential,
+      id: decodeBase64Url(credential.id),
+      transports: credential.transports as AuthenticatorTransport[] | undefined,
+    }));
+    delete parsed.exclude_credentials;
+  }
+  return parsed as unknown as PublicKeyCredentialCreationOptions;
+}
+
+function serializeCreationCredential(
+  credential: PublicKeyCredential,
+): Record<string, unknown> {
+  const response = credential.response as AuthenticatorAttestationResponse;
+  return {
+    id: credential.id,
+    rawId: encodeBase64Url(credential.rawId),
+    type: credential.type,
+    response: {
+      clientDataJSON: encodeBase64Url(response.clientDataJSON),
+      attestationObject: encodeBase64Url(response.attestationObject),
+      transports: response.getTransports?.(),
+    },
+  };
+}
+
+export default defineComponent({
+  name: 'MfaSettingsCard',
+  data() {
+    return {
+      loading: true,
+      actionLoading: false,
+      error: false,
+      success: '',
+      authenticators: [] as Authenticator[],
+      recoveryCodes: [] as string[],
+      passkeyName: '',
+      reauthenticatePrompt: false,
+      reauthenticatePassword: '',
+      reauthenticateError: false,
+      reauthenticating: false,
+      pendingAction: null as (() => Promise<void>) | null,
+      totpSetup: null as {
+        secret: string;
+        qrCode: string;
+        code: string;
+      } | null,
+    };
+  },
+  computed: {
+    client(): string {
+      return Platform.is.capacitor ? 'app' : 'browser';
+    },
+    hasTotp(): boolean {
+      return this.authenticators.some(
+        (authenticator) => authenticator.type === 'totp',
+      );
+    },
+  },
+  async mounted() {
+    await this.loadAuthenticators();
+  },
+  methods: {
+    path(path: string): string {
+      return `/_allauth/${this.client}/v1${path}`;
+    },
+    headers() {
+      return { Accept: 'application/json' };
+    },
+    authenticatorKey(authenticator: Authenticator): string {
+      return `${authenticator.type}-${authenticator.id || authenticator.created_at}`;
+    },
+    authenticatorLabel(authenticator: Authenticator): string {
+      return (
+        authenticator.name || this.authenticatorTypeLabel(authenticator.type)
+      );
+    },
+    authenticatorTypeLabel(type: string): string {
+      const labels: Record<string, string> = {
+        totp: this.$t('mfaSettings.totp'),
+        webauthn: this.$t('mfaSettings.passkey'),
+        recovery_codes: this.$t('mfaSettings.recoveryCodes'),
+      };
+      return labels[type] || type;
+    },
+    async loadAuthenticators() {
+      this.loading = true;
+      this.error = false;
+      try {
+        const response = await this.$axios.get(
+          this.path('/account/authenticators'),
+          { headers: this.headers() },
+        );
+        this.authenticators = response.data.data || [];
+      } catch {
+        this.error = true;
+      } finally {
+        this.loading = false;
+      }
+    },
+    async beginTotpSetup() {
+      this.actionLoading = true;
+      this.error = false;
+      try {
+        const response = await this.$axios.get(
+          this.path('/account/authenticators/totp'),
+          { headers: this.headers() },
+        );
+        this.setTotpSetup(response.data);
+      } catch (error) {
+        if (error.response?.status === 404) {
+          this.setTotpSetup(error.response.data);
+        } else {
+          this.error = true;
+        }
+      } finally {
+        this.actionLoading = false;
+      }
+    },
+    async setTotpSetup(data) {
+      const meta = data?.meta || {};
+      if (!meta.secret || !meta.totp_url) {
+        this.error = true;
+        return;
+      }
+      this.totpSetup = {
+        secret: meta.secret,
+        qrCode: await QRCode.toDataURL(meta.totp_url),
+        code: '',
+      };
+    },
+    cancelTotpSetup() {
+      this.totpSetup = null;
+    },
+    async activateTotp() {
+      if (!this.totpSetup?.code) return;
+      await this.runAction(async () => {
+        await this.$axios.post(
+          this.path('/account/authenticators/totp'),
+          { code: this.totpSetup.code },
+          { headers: this.headers() },
+        );
+        this.totpSetup = null;
+        this.success = this.$t('mfaSettings.saved');
+        await this.loadAuthenticators();
+      });
+    },
+    async addPasskey() {
+      await this.runAction(async () => {
+        const optionsResponse = await this.$axios.get(
+          `${this.path('/account/authenticators/webauthn')}?passwordless`,
+          { headers: this.headers() },
+        );
+        const creationOptions = optionsResponse.data.data?.creation_options;
+        const credential = await navigator.credentials.create({
+          publicKey: parseCreationOptions(creationOptions),
+        });
+        if (!credential) throw new Error('Passkey registration was cancelled.');
+        await this.$axios.post(
+          this.path('/account/authenticators/webauthn'),
+          {
+            name: this.passkeyName.trim(),
+            passwordless: true,
+            credential: serializeCreationCredential(
+              credential as PublicKeyCredential,
+            ),
+          },
+          { headers: this.headers() },
+        );
+        this.passkeyName = '';
+        this.success = this.$t('mfaSettings.saved');
+        await this.loadAuthenticators();
+      });
+    },
+    async generateRecoveryCodes() {
+      await this.runAction(async () => {
+        const response = await this.$axios.post(
+          this.path('/account/authenticators/recovery-codes'),
+          {},
+          { headers: this.headers() },
+        );
+        this.recoveryCodes = response.data.data?.unused_codes || [];
+        this.success = this.$t('mfaSettings.saved');
+        await this.loadAuthenticators();
+      });
+    },
+    async disableTotp() {
+      const options: QDialogOptions = {
+        title: this.$t('mfaSettings.disableTotp'),
+        message: this.$t('mfaSettings.confirmDisable'),
+        cancel: true,
+        persistent: true,
+      };
+      Dialog.create(options).onOk(() => this.removeTotp());
+    },
+    async removeTotp() {
+      await this.runAction(async () => {
+        await this.$axios.delete(this.path('/account/authenticators/totp'), {
+          headers: this.headers(),
+        });
+        this.success = this.$t('mfaSettings.saved');
+        await this.loadAuthenticators();
+      });
+    },
+    async removePasskey(id?: number) {
+      if (!id) return;
+      await this.runAction(async () => {
+        await this.$axios.delete(
+          this.path('/account/authenticators/webauthn'),
+          {
+            data: { authenticators: [id] },
+            headers: this.headers(),
+          },
+        );
+        this.success = this.$t('mfaSettings.saved');
+        await this.loadAuthenticators();
+      });
+    },
+    isReauthenticationRequired(error): boolean {
+      return (
+        error.response?.status === 401 &&
+        error.response.data?.data?.flows?.some(
+          (flow) => flow.id === 'reauthenticate',
+        )
+      );
+    },
+    cancelReauthenticate() {
+      this.reauthenticatePrompt = false;
+      this.reauthenticatePassword = '';
+      this.reauthenticateError = false;
+      this.pendingAction = null;
+    },
+    async submitReauthenticate() {
+      if (!this.reauthenticatePassword || !this.pendingAction) return;
+      this.reauthenticating = true;
+      this.reauthenticateError = false;
+      try {
+        await this.$axios.post(
+          this.path('/auth/reauthenticate'),
+          { password: this.reauthenticatePassword },
+          { headers: this.headers() },
+        );
+        const action = this.pendingAction;
+        this.cancelReauthenticate();
+        if (!action) return;
+        await action();
+      } catch {
+        this.reauthenticateError = true;
+      } finally {
+        this.reauthenticating = false;
+      }
+    },
+    async runAction(action: () => Promise<void>) {
+      this.actionLoading = true;
+      this.error = false;
+      this.success = '';
+      try {
+        await action();
+      } catch (error) {
+        if (this.isReauthenticationRequired(error)) {
+          this.pendingAction = action;
+          this.reauthenticatePrompt = true;
+          this.reauthenticateError = false;
+        } else {
+          this.error = true;
+        }
+      } finally {
+        this.actionLoading = false;
+      }
+    },
+  },
+});
+</script>
+
+<style scoped>
+.mfa-settings-card {
+  width: 600px;
+  max-width: 90vw;
+}
+
+.mfa-recovery-codes {
+  display: block;
+  white-space: pre-wrap;
+  padding: 0.75rem;
+  background: var(--q-color-grey-2);
+}
+</style>
diff --git a/src-frontend/src/i18n/en-AU/index.ts b/src-frontend/src/i18n/en-AU/index.ts
index d5973b1f..ee6ee347 100644
--- a/src-frontend/src/i18n/en-AU/index.ts
+++ b/src-frontend/src/i18n/en-AU/index.ts
@@ -213,6 +213,38 @@ export default {
     unverifiedEmail:
       'Your email address is not verified. We just sent you another link so please try again.',
   },
+  mfaSettings: {
+    title: 'Multi-factor authentication',
+    description:
+      'Add an authenticator app, passkey, or recovery codes to protect your account.',
+    noMethods: 'No MFA methods are configured.',
+    totp: 'Authenticator app',
+    passkey: 'Passkey',
+    recoveryCodes: 'Recovery codes',
+    enableTotp: 'Set up authenticator app',
+    addPasskey: 'Add passkey',
+    passkeyName: 'Passkey name',
+    passkeyNameHint: 'For example: MacBook, iPhone, or YubiKey',
+    disableTotp: 'Disable authenticator app',
+    removePasskey: 'Remove passkey',
+    generateRecoveryCodes: 'Generate recovery codes',
+    setupDescription:
+      'Scan the QR code with your authenticator app, then enter the generated code.',
+    setupKey: 'Setup key',
+    verificationCode: 'Authentication code',
+    recoveryCodesDescription:
+      'Store these recovery codes somewhere safe. Each code can be used once.',
+    confirmDisable:
+      'Disabling your authenticator app reduces the security of your account. Continue?',
+    saved: 'MFA settings saved.',
+    failed: 'Unable to update MFA settings. Please try again.',
+    reauthenticateTitle: 'Confirm your password',
+    reauthenticateDescription:
+      'Enter your current password to continue changing MFA settings.',
+    reauthenticatePassword: 'Current password',
+    reauthenticate: 'Continue',
+    reauthenticateFailed: 'The password was incorrect. Please try again.',
+  },
   changePasswordCard: {
     pageTitle: 'Change Password',
     success: 'Your new password was saved successfully.',
diff --git a/src-frontend/src/i18n/sv-SE/index.ts b/src-frontend/src/i18n/sv-SE/index.ts
index d895d7dd..ae67717e 100644
--- a/src-frontend/src/i18n/sv-SE/index.ts
+++ b/src-frontend/src/i18n/sv-SE/index.ts
@@ -207,6 +207,38 @@ export default {
     unverifiedEmail:
       'Din email är inte verifierad. Vi skickade precies en ny länk via email så försök verifiera igen.',
   },
+  mfaSettings: {
+    title: 'Multifaktorautentisering',
+    description:
+      'Lägg till en autentiseringsapp, lösenordsnyckel eller återställningskoder för att skydda ditt konto.',
+    noMethods: 'Inga MFA-metoder är konfigurerade.',
+    totp: 'Autentiseringsapp',
+    passkey: 'Lösenordsnyckel',
+    recoveryCodes: 'Återställningskoder',
+    enableTotp: 'Konfigurera autentiseringsapp',
+    addPasskey: 'Lägg till lösenordsnyckel',
+    passkeyName: 'Namn på lösenordsnyckel',
+    passkeyNameHint: 'Till exempel: MacBook, iPhone eller YubiKey',
+    disableTotp: 'Inaktivera autentiseringsapp',
+    removePasskey: 'Ta bort lösenordsnyckel',
+    generateRecoveryCodes: 'Skapa återställningskoder',
+    setupDescription:
+      'Skanna QR-koden med din autentiseringsapp och ange sedan den genererade koden.',
+    setupKey: 'Installationsnyckel',
+    verificationCode: 'Autentiseringskod',
+    recoveryCodesDescription:
+      'Förvara återställningskoderna säkert. Varje kod kan användas en gång.',
+    confirmDisable:
+      'Att inaktivera autentiseringsappen minskar kontots säkerhet. Vill du fortsätta?',
+    saved: 'MFA-inställningarna har sparats.',
+    failed: 'MFA-inställningarna kunde inte uppdateras. Försök igen.',
+    reauthenticateTitle: 'Bekräfta ditt lösenord',
+    reauthenticateDescription:
+      'Ange ditt nuvarande lösenord för att fortsätta ändra MFA-inställningar.',
+    reauthenticatePassword: 'Nuvarande lösenord',
+    reauthenticate: 'Fortsätt',
+    reauthenticateFailed: 'Lösenordet var felaktigt. Försök igen.',
+  },
   changePasswordCard: {
     pageTitle: 'Byt lösenord',
     success: 'Ditt nya lösenord har ändrats.',
diff --git a/src-frontend/src/pages/Profile.vue b/src-frontend/src/pages/Profile.vue
index e330f63d..8bd0946d 100644
--- a/src-frontend/src/pages/Profile.vue
+++ b/src-frontend/src/pages/Profile.vue
@@ -63,6 +63,13 @@
       @click="changePassword = true"
     />
 
+    <q-btn
+      color="primary"
+      :label="$t('mfaSettings.title')"
+      class="profile-action-btn q-mb-sm"
+      @click="mfaSettings = true"
+    />
+
     <q-btn
       color="toolbar"
       :icon="icons.digitalId"
@@ -101,6 +108,10 @@
     <q-dialog v-model="changePassword">
       <change-password-card />
     </q-dialog>
+
+    <q-dialog v-model="mfaSettings">
+      <mfa-settings-card />
+    </q-dialog>
   </q-page>
 </template>
 
@@ -109,16 +120,23 @@ import ProfileForm from '@components/ProfileForm.vue';
 import icons from '../icons';
 import DigitalIdCard from '@components/DigitalIdCard.vue';
 import ChangePasswordCard from '@components/ChangePasswordCard.vue';
+import MfaSettingsCard from '@components/MfaSettingsCard.vue';
 import { mapGetters } from 'vuex';
 
 export default {
   name: 'ProfilePage',
-  components: { ChangePasswordCard, DigitalIdCard, ProfileForm },
+  components: {
+    ChangePasswordCard,
+    DigitalIdCard,
+    MfaSettingsCard,
+    ProfileForm,
+  },
   data() {
     return {
       text: '',
       digitalId: false,
       changePassword: false,
+      mfaSettings: false,
     };
   },
   computed: {