Chest can require two-step verification without a company identity provider. In Administration → Two-step sign-in policy, require it for everyone or selected groups, select the enrollment grace period, and set session length and idle timeout. Email verification alone cannot open content while enrollment is pending. A grace period gives people time to arrange an authenticator; it never grants temporary file access.
Every person uses Account security to connect an authenticator app, passkey or FIDO2 security key. Scan support is not required: enter the setup key in your authenticator and confirm its six-digit time-based code. Save recovery codes privately; each works once, and making a new set replaces the old set. An administrator policy can require a passkey or security key. A recovery code then permits replacement enrollment without opening content under that policy. SMS is not supported.
A person who loses every factor contacts a help-desk administrator. After separately verifying their identity, the administrator sends a reset from Administration. The email contains a single-use link valid for 24 hours. The person signs in by email and opens that link, then enrolls again. Resetting revokes other browser sessions and all device credentials and notifies the person. Keep recovery codes and another administrator available. Help-desk group scope is checked against the person being reset.
Company sign-in can rely on the provider's own MFA policy or require verified MFA evidence. The latter accepts OIDC amr: mfa or an explicit SAML MFA authentication context; it refuses a provider response without it. The native key-only admin policy additionally requires a Chest passkey/security key.
Session length is measured from the initial sign-in, and idle timeout from the last authorized request. Devices are enrolled only from a factor-qualified session and obey the same limits; expired credentials must be replaced after sign-in. Factor material, recovery hashes, challenges and reset authority are excluded from portable exports. Restoring into another installation retains the policy but requires new enrollment. Keep the installation's SESSION_SECRET private: it seals authenticator secrets and credential records at rest.