# client.auth.settings

> client.auth.settings — the auth.settings operations.

`client.auth.settings` — the `auth.settings` operations.

On `AsyncKindgi` every method is the same, awaited.

## `client.auth.settings.get()`

```python signature
get(*, timeout: float | None = None) -> AuthSettings
```

The workspace's sign-in settings. `GET /v1/auth/settings`

Whether signing in takes a second factor, and how many people's keys are still on the deployment's previous sign-in secret, or on neither. Tenant admins only. Mounted when the deployment keeps second factors (from 0.1.9).

## `client.auth.settings.update()`

```python signature
update(
    body: AuthSettingsPatch | Mapping[str, Any] | None = None,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> AuthSettings
```

Require a second factor at sign-in. `PATCH /v1/auth/settings`

Covers signing in by the deployment's own ways in (the emailed link, and providers like Google, Microsoft and GitHub). Signing in through the workspace's own identity provider is exempt: it owns MFA there. A site's people sign in through the site, which owns their second factor, so the setting doesn't apply to them. Once required, a session made without a second factor ends at its next request, and signing in to the console with an API token is refused. API keys aren't covered: keep them to service accounts, and rotate them. From a session, turning it on takes a session made with your own second factor (`409 second-factor-enroll-first`): it would end yours. Audited. Tenant admins only. Mounted when the deployment keeps second factors (from 0.1.9).