Note that as of release 1.68.0 (released in late Jun 2026), there is a mfa_deleter role that can remove MFA from a user.

Please see the release notes for more details.

Since we can’t store API keys in code,

FYI, with the release of 1.64.0, you now can store secrets elsewhere and have lambdas retrieve them.

See the documentation for more details.

@nikola Have you checked out our kickstarts or APIs? You should be able to apply the license keys and configure your environments as needed.

If this isn't what you mean, please just give me a little more detail on what you are trying to do and I'll help the best I can.

@anthea-mo It looks like the fix is to upgrade.

I also found this on the users accounts being locked.

If this information does not get you where you need, please let me know.

As of 1.62.0, FusionAuth supports pre-verification of emails and phone numbers.

More details:

https://fusionauth.io/docs/lifecycle/manage-users/verification/identity-pre-verification-using-email

https://fusionauth.io/docs/lifecycle/manage-users/verification/identity-pre-verification-using-phone

You have a couple of options.

• If you use the hosted login pages/authorization code grant, disabling all grants in the application settings page will prevent people from logging in.
• If you use the login API and have customer-based API keys, you could turn on the 'require API key for login API' and then disable the customer's API key.
• If you have the Enterprise plan, you could set up an IP ACL for a unroutable IP range.

However, the easiest way to make sure an application cannot be logged into is to deactivate the application.

Is there a way to disable logging into an application without disabling/deleting it?

Per https://github.com/FusionAuth/fusionauth-issues/issues/1810 I'm not clear what my options are.

@mqwirtnuf How's it going? Can you share your upgrade process?

Lots of options!

• Self-service password recovery — SMS or Email based forgot password flows out of the box, with hosted pages that require no custom UI. If a user's login ID is a phone number, the reset is delivered via SMS automatically.
• API-driven recovery — The full forgot password flow is triggerable via POST /api/user/forgot-password with an email, phone, or username as the login ID, giving teams complete control over the UI and recovery experience.
• Admin and support-assisted recovery — Support staff can trigger resets or force password changes directly from the admin UI, no email required.
• Admins can also remove MFA methods directly from the user record.
• MFA recovery — Recovery codes generated at MFA enrollment let users bypass a lost second factor.
• Self-service MFA configuration — Users can add, remove, and manage their own MFA methods (TOTP, SMS, email) from a hosted self-service account page without any admin involvement. Removing a method requires completing an MFA challenge first, which prevents unauthorized removal. If an admin removes a user's MFA method and the tenant or application policy is set to Required, the user will be prompted to set up MFA again on next login.
• Webhooks and event-driven recovery — FusionAuth fires events like user.login.failed and user.password.reset that your backend can listen to and act on, enabling custom recovery logic, audit trails, and downstream notifications.
• Account linking and IdP recovery — For users who log in via a social or enterprise IdP, FusionAuth can be configured to link that identity to a FusionAuth user record. If the IdP connection is the issue, the user can still go through the standard forgot password flow as long as an phone number or email is on their account, so recovery isn't solely dependent on the IdP being available.

What are account recovery options available with FusionAuth?