# Opal 2FA questions

**URL:** <https://datashield.discourse.group/t/opal-2fa-questions/1461>\
**Category:** Support\
**Created:** [8 April 2026 09:53 UTC](https://datashield.discourse.group/t/opal-2fa-questions/1461 "2026-04-08T09:53:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![florian.schwarz](https://avatars.discourse-cdn.com/v4/letter/f/73ab20/32.png) [@florian.schwarz](https://datashield.discourse.group/u/florian.schwarz)\
**Post date:** [8 April 2026 09:53 UTC](https://datashield.discourse.group/t/opal-2fa-questions/1461/1 "2026-04-08T09:53:31Z")

</div>

Hi @yannick et al.,

I have two questions regarding the 2FA on Opal:

1. When the 2FA is enforced, the user can still disable it themselves in the Opal UI (after setting it up). I am not sure if that is possible so that users can reset their 2FA in case of a new phone etc. but as an administrator that seemed counterintuitive. In the R environment, the user is still prompted to enter the 6 digits code, so the enforcement works here. I was just wondering whether the option to disable should be greyed out for users in the UI or replaced with a “replace/refresh 2FA” button when this is enforced by the admin.

2. I haven’t tested it, but if multiple organisations require 2FA, how will that work for the user in the R environment? Will they have to enter codes sequentially, depending on what login Name is currently shown?

Thanks, Florian

---

<div class="post-metadata">

**Author:** ![yannick](https://yyz2.discourse-cdn.com/free1/user_avatar/datashield.discourse.group/yannick/32/19_2.png) [@yannick](https://datashield.discourse.group/u/yannick)\
**Post date:** [8 April 2026 17:30 UTC](https://datashield.discourse.group/t/opal-2fa-questions/1461/2 "2026-04-08T17:30:49Z")

</div>

Hi Florian,

1. When 2FA is enforced, the user will be _always_ requested a one-time code at login (either from a new or an existing secret key). Then the “disable 2FA” option (probably not well named) will have limited effect (until next login).
2. In the R environment, the user is requested to enter the code in the console prompt. It works in DataSHIELD as well since logins are done sequentially:

 ![image](https://global.discourse-cdn.com/free1/uploads/datashield1/original/1X/c6ad26861a141eb998cc21b415a6dfac8ce082cc.png)

This being said, for programmatic usage (then DataSHIELD) it is strongly recommended to use Personal Access Tokens, which are more volatile (expiration), scoped (features and projects) and revokable (to minimize impact of leaks in source code).

> **[opal.token\* - How to Manage Authentication and Authorizations — Opal ...](https://opaldoc.obiba.org/en/latest/cookbook/r-datashield/authz.html#use-personal-access-token)**
>
> It is recommended to grant permissions by group, and then assign each user to the appropriate groups.

Cheers  
Yannick

---

<div class="post-metadata">

**Author:** ![florian.schwarz](https://avatars.discourse-cdn.com/v4/letter/f/73ab20/32.png) [@florian.schwarz](https://datashield.discourse.group/u/florian.schwarz)\
**Post date:** [9 April 2026 06:07 UTC](https://datashield.discourse.group/t/opal-2fa-questions/1461/3 "2026-04-09T06:07:48Z")

</div>

Hi Yannick,

thanks for the clarification!

Best,

Florian