# Two-factor authentication for Application Builder users, on the roadmap?
**URL:** https://community.baserow.io/t/two-factor-authentication-for-application-builder-users-on-the-roadmap/12967
**Category:** Feature Ideas
**Tags:** authentification, app
**Created:** [September 25, 2026, 8:29am UTC](https://community.baserow.io/t/two-factor-authentication-for-application-builder-users-on-the-roadmap/12967 "2026-09-25T08:29:18Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@tonyf](https://community.baserow.io/u/tonyf)
#### Post date: [September 25, 2026, 8:29am UTC](https://community.baserow.io/t/two-factor-authentication-for-application-builder-users-on-the-roadmap/12967/1 "2026-09-25T08:29:18Z")
Hello,
If I understand correctly, there is currently no way to enable two-factor authentication (e.g., TOTP or a code sent via email) for app users. SSO (SAML/OIDC) works well for internal staff who already have a company identity provider. For external users, it would mean deploying and maintaining a dedicated identity provider just to get 2FA, which is complicate and disproportionate for small businesses.
Is two-factor authentication for app users on the roadmap? And in the meantime, is there a recommended approach to strengthen login security for external users?
Thank you for your help!
---
### Author:  [@AgustinCarozo](https://community.baserow.io/u/AgustinCarozo)
#### Post date: [September 25, 2026, 5:53pm UTC](https://community.baserow.io/t/two-factor-authentication-for-application-builder-users-on-the-roadmap/12967/2 "2026-09-25T17:53:59Z")
Hi Tony đź‘‹,
2FA for app users is not currently in our roadmap.
But I’ll submit this as a feature request.
I believe an identity provider could be the smart solution in this case.
---
### Author:  [@jeandavid](https://community.baserow.io/u/jeandavid)
#### Post date: [September 28, 2026, 7:07pm UTC](https://community.baserow.io/t/two-factor-authentication-for-application-builder-users-on-the-roadmap/12967/3 "2026-09-28T19:07:39Z")
Hello!
I understood you could do something similar to this with a code sent by email using a magic link template:
- [A simple magic link sign-up flow built in Baserow](https://community.baserow.io/t/a-simple-magic-link-sign-up-flow-built-in-baserow/12417)
- [Password reset](https://baserow.io/templates/password-reset)
I plan to try this but I haven’t yet.
---
### Author:  [@tonyf](https://community.baserow.io/u/tonyf)
#### Post date: [September 29, 2026, 8:09am UTC](https://community.baserow.io/t/two-factor-authentication-for-application-builder-users-on-the-roadmap/12967/4 "2026-09-29T08:09:50Z")
Thanks for sharing this, great idea !
So, after logging in with their password, the user receives a code via email and must enter it to continue.
I’m going to test this out. I’ve already noted that, for the solution to be secure, the code must never appear in a data source, and the time limit and number of attempts must be restricted.
I’ll keep you posted.
---
### Author:  [@jeandavid](https://community.baserow.io/u/jeandavid)
#### Post date: [September 29, 2026, 10:23am UTC](https://community.baserow.io/t/two-factor-authentication-for-application-builder-users-on-the-roadmap/12967/5 "2026-09-29T10:23:40Z")
I could be a code, or a link with the code or with an uuid… I guess this is limited by what you can do in the application and workflow builders, but some things seem possible.
Yes I’d like to hear from you implementation, good luck!
---
### Author:  [@tonyf](https://community.baserow.io/u/tonyf)
#### Post date: [October 2, 2026, 3:48pm UTC](https://community.baserow.io/t/two-factor-authentication-for-application-builder-users-on-the-roadmap/12967/6 "2026-10-02T15:48:37Z")
> [@jeandavid](#):
>
> I could be a code, or a link with the code or with an uuid… I guess this is limited by what you can do in the application and workflow builders, but some things seem possible.
>
> Yes I’d like to hear from you implementation, good luck!
Hello,
Here’s what I’ve tested: two-factor authentication via a code sent by email for Application Builder users, using n8n.
1 The user logs in with their email address and password. Their role is reset to “pending.”
2 On a verification page, a button triggers an n8n webhook (the “Send an HTTP Request” action). n8n generates a 6-digit code, stores only a hash of it along with an expiration time and a limit on the number of attempts, and then sends the code via email.
3 The user enters the code. n8n verifies it and, if valid, changes the user’s role to “verified,” then returns a positive or negative response so that the application can display the appropriate page.
4 Protected pages are visible only to users with the “verified” role.
5 The role is reset to “pending” upon logout, and verification expires after a defined period.
The entire workflow appears to function on a test instance. Before going live, numerous tests still need to be performed.
That said, this is still a workaround: native two-factor authentication for app users, managed by Baserow, would remain the ideal solution.
Thanks to @jeandavid for the idea!
---
### Author:  [@olgatrykush](https://community.baserow.io/u/olgatrykush)
#### Post date: [October 5, 2026, 10:02am UTC](https://community.baserow.io/t/two-factor-authentication-for-application-builder-users-on-the-roadmap/12967/7 "2026-10-05T10:02:08Z")
Hello @tonyf, thanks for sharing what worked for you! I quickly checked with the team, and while 2FA isn’t on the roadmap yet, we do have [user source magic links](https://github.com/baserow/baserow/issues/5563) planned. Hope this helps!