Setting up multi-factor authentication

MFA is required on every Ralt Rounds account. Here's the 3-minute setup flow and how to recover if you lose your device.

Updated 2026-04-24 · Edit this page on GitHub

title: "Setting up multi-factor authentication" description: "MFA is required on every Ralt Rounds account. Here's the 3-minute setup flow and how to recover if you lose your device." order: 2 category: "getting-started" updated_at: "2026-04-24"

Rounds requires MFA via an authenticator app before you can see clinical or financial data. Healthcare data regulation (HIPAA §164.312(d)) doesn't technically mandate MFA, but sane security does.

What you need

  • A smartphone with a TOTP authenticator app installed:
    • 1Password (preferred if you use it for passwords)
    • Authy (free, multi-device sync)
    • Google Authenticator, Microsoft Authenticator (also fine)
  • ~3 minutes

Steps

  1. After your first magic-link login, Rounds routes you to /auth/mfa-setup.
  2. Scan the QR code with your authenticator app. (Or copy the secret string manually if you can't scan — usually because you're on a phone browser.)
  3. Your app will show a 6-digit code that rotates every 30 seconds.
  4. Enter the current code in the Rounds field + click "Enroll."
  5. Rounds confirms + drops you on the homepage.

After enrollment

Every subsequent sign-in: click the magic link → enter the 6-digit code from your app → you're in.

If you lose your device

Your practice owner can reset your MFA factor from the admin UI. Fastest path:

  1. Text or email your practice owner — they go to /admin/users, click your row, and click "Reset MFA."
  2. Next time you try to sign in, Rounds routes you back through /auth/mfa-setup with a fresh QR code.
  3. Enroll on your new device.

If you ARE the practice owner and lose your device: email support@ralthealth.com from an email address on file with Rounds. We'll verify identity and reset your factor manually.

Backup codes

Not supported in v1. On the post-v1 roadmap. Until then: keep your authenticator app's cloud sync turned on (1Password + Authy both offer this) as your backup.

If you hit a problem

  • Clock drift is the most common cause of "invalid code" errors — the authenticator app and Rounds must agree on current time. Restart your phone if its clock looks off.
  • If the QR code won't scan, manually enter the secret string shown below the code.
  • Email support@ralthealth.com if you're stuck.