Go to developer

Disable 2FA

Revoke an enrolled KEYRA identity for a partner user when 2FA should no longer apply.

On this page

When to disable

Use disable when your product allows users or admins to turn off KEYRA 2FA, or when offboarding requires clearing the KEYRA binding. Require confirmation in your UI — this is destructive to the enrollment.

Call disable2FA

SERVERTypeScript
await keyra.disable2FA(externalUserId);
// Resolves identity via get2FAStatus, then POST /v1/identities/{identityId}/disable
SERVERJava
keyra.disable2FA(userId);

Effects

  • Identity status becomes revoked.
  • Subsequent get2FAStatus behaves as not enrolled (enrolled: false, status none for revoked identities in the status handler).
  • Already-missing / already-revoked identity → HTTP 404 not_found.
  • Already-open challenges are not explicitly cancelled by this call in the current implementation — avoid starting new challenges after disable and apply your own policy for incomplete ones.

Re-enrollment

After disable, run a fresh enable2FA flow when the user should enroll again. Do not assume prior enrollment sessions remain valid.