MFA Providers
When a sign-in needs MFA, AuthNull sends a push to the user's phone through your organization's MFA provider. Today AuthNull supports:
| Provider | Push app | Best for |
|---|---|---|
 Duo Security | Duo Mobile | Organizations that use Duo |
 Okta Verify | Okta Verify | Organizations that use Okta |
One provider is active per organization, and it is used for every product: Identity, Database, RADIUS, and PAM.
AuthNull Authenticator - AuthNull's own push app - is not released yet. Its card already appears on the MFA Provider page, but choose Duo Security or Okta Verify until the app is available. See AuthNull Authenticator (Coming Soon).
Choose a Provider
Open the account menu (top right), choose Settings, then MFA Provider, and select a provider card. Only one provider can be active: once Duo Security or Okta Verify is saved, the other card shows Remove the active provider to switch.
Duo Security
Enter the details of your Duo application:
| Field | Example |
|---|---|
| API hostname | api-XXXXXXXX.duosecurity.com |
| Integration key | DI... |
| Secret key | Your Duo secret key |
Users must be enrolled in Duo Mobile before you enforce MFA.
Okta Verify
Enter your Okta organization's details:
| Field | Example |
|---|---|
| Okta org URL | acme.okta.com |
| API token | An Okta API token (00T...) |
Users must have Okta Verify enrolled in your Okta organization.
AuthNull finds each user in Duo or Okta by email address. A user's email in AuthNull must match their Duo or Okta account, or the push cannot be delivered.
When you edit a saved provider, leave the secret fields blank to keep the stored values.
Provider Status
| Status | Meaning |
|---|---|
| Active | Configured for this organization; credentials are stored encrypted per organization |
| Deployment default | Not configured for this organization - inherited from the deployment's default setting |
| Incomplete | Saved, but some required details are missing |
On the Users page, users show MFA managed by Duo Security or Okta Verify: their second factor is enrolled there, not in AuthNull.
How Users Sign In to the Console
Signing in to the AuthNull console itself uses a password plus a second factor - an authenticator app code (TOTP), a passkey, or a push. See End-User Console Access.